Harley-Davidson employees and others whose personal information may have been exposed in a 2026 ransomware attack claimed by the Cl0p group may be covered by a proposed class action alleging Harley-Davidson failed to protect that data. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Harley-Davidson has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
A former Harley-Davidson employee filed a proposed class action against the Milwaukee motorcycle maker in the U.S. District Court for the Eastern District of Wisconsin in November 2026, according to Bloomberg Law. The complaint alleges Harley-Davidson failed to adequately protect personal information that could be used for identity theft. Bloomberg Law reports that the complaint does not detail exactly which data was taken. These are allegations; Harley-Davidson has not answered them in court and no judge has ruled. A case number has not been reported.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Happened?
Around September 10, 2026, the Cl0p ransomware group added Harley-Davidson to its leak site and claimed to have stolen about 270 GB of internal data, which security outlets linked to the company’s Windchill product lifecycle management system, according to Cybernews and Cybersecurity News. Bloomberg Law reports that Cl0p allegedly leaked the data online after Harley-Davidson declined to pay a ransom. Harley-Davidson has not publicly confirmed the breach, which systems were affected or whether customer, employee or dealer information was involved, and one analysis noted Cl0p initially offered no sample files to back up its claim.Cl0p has used flaws in widely used file-transfer and business software to hit many companies at once, including the 2023 MOVEit campaign. Reports tie the Harley-Davidson claim to a broader campaign against Windchill users, but that link has not been confirmed by the company.
What Does the Lawsuit Claim?
The former employee alleges Harley-Davidson did not take reasonable steps to safeguard personal information it held, exposing employees and others to a risk of identity theft. Data breach complaints of this kind typically assert negligence and related claims and seek damages, credit monitoring and court-ordered security improvements on behalf of everyone whose data was involved. Harley-Davidson has not responded in court, and no court has found it liable.What Happens Next?
Harley-Davidson will respond to the complaint, often with a motion to dismiss. If the company confirms that personal information was taken, it would send breach notices to affected people describing what was involved, and more lawsuits often follow those notices. Any payment would come only from a later settlement or judgment approved by the court.Questions
Did Harley-Davidson confirm a data breach?
Not publicly, based on the coverage reviewed for this page. The Cl0p ransomware group claimed in September 2026 to have stolen about 270 GB of Harley-Davidson data, and a former employee’s lawsuit alleges personal information was exposed, but Harley-Davidson has not publicly described what was taken.
Who is covered by the Harley-Davidson data breach lawsuit?
The lawsuit was filed by a former employee on behalf of a proposed class of people whose personal information was exposed. The exact class definition has not been reported. No class has been certified.
What is Cl0p?
Cl0p is a ransomware and extortion group known for stealing data through flaws in business software used by many companies at once, including the 2023 MOVEit file-transfer campaign. Its claims about victims are its own and are not always confirmed.
Can I file a claim in the Harley-Davidson data breach lawsuit?
No. The case is a proposed class action at the complaint stage. No class has been certified, there is no settlement and there is no claim form. A claim process exists only if the case settles or wins and a court approves notice to class members.
Sources
- Bloomberg Law: Harley-Davidson hit with proposed data breach class action (Nov. 11, 2026)
- Cybernews: Cl0p Harley-Davidson breach claims 270GB internal data leak
- Cybersecurity News: Harley-Davidson alleged breach
