Harley-Davidson Data Breach Class Action Lawsuit 2026, Sadler v. Harley-Davidson Over Alleged 270GB Cl0p Hack, Who Is Affected?

Harley-Davidson Inc. is facing a new proposed federal class action lawsuit. A former employee accuses the Milwaukee-based motorcycle maker of failing to protect personal information after a September 2026 cyberattack claimed by the Cl0p hacking group.

Roger Sadler, a Missouri resident and former Harley-Davidson employee, filed the lawsuit on November 10, 2026, in the U.S. District Court for the Eastern District of Wisconsin. Bloomberg Law reported the filing on November 11, 2026. The case is Sadler v. Harley-Davidson, Inc., No. 2:26-cv-02088.

Cl0p claims it stole about 270 gigabytes of internal data, including material tied to PTC Windchill, a product lifecycle management platform, and published it online by torrent after the company did not engage with the group.

Important: Harley-Davidson has not confirmed the scope of the intrusion, the number of people affected or the types of personal information exposed. The 270GB figure comes from the hackers’ claim and cybersecurity reporting. It is not a verified count of personal records.

There is currently no Harley-Davidson data breach settlement, no settlement fund, no official claim form and no claim deadline.

Harley-Davidson Data Breach Lawsuit: Quick Facts

Detail	Information
Case name	Sadler v. Harley-Davidson, Inc.
Case number	2:26-cv-02088
Filed	November 10, 2026 (reported by Bloomberg Law November 11, 2026)
Court	U.S. District Court, Eastern District of Wisconsin
Plaintiff	Roger Sadler, former employee, Missouri resident
Defendant	Harley-Davidson, Inc.
Type of case	Proposed (putative) class action
Reported incident	September 2026 alleged cyberattack
Group claiming responsibility	Cl0p
Alleged data volume	Approximately 270GB
Software reportedly involved	PTC Windchill
Alleged wrongdoing	Failure to adequately protect personal information
Official settlement website	None. No settlement exists
Official claim form	None. No claim form exists
Claim deadline	None
Class certified?	No
Confirmed affected individuals	Not established
Confirmed data categories	Not publicly established
Liability finding	None
Current status	Earliest stage of federal litigation

Why Is Roger Sadler Suing Harley-Davidson?

Sadler alleges Harley-Davidson did not maintain reasonable security measures to protect personal information entrusted to it, and that this created risks of identity theft and other misuse. According to Bloomberg Law, the complaint concerns data allegedly compromised in the September incident, but the publicly reported details do not specify exactly which categories of personal data were exposed.

Typical claims in data breach class actions include negligence, breach of implied contract and violations of state consumer-protection or data-privacy laws. The full complaint was not independently available for this article, so the exact legal claims Sadler asserts should be confirmed against the docket.

These are allegations, not court findings. A hacker’s claim does not automatically prove the company was negligent. The plaintiff must establish each element of every cause of action, including a legally recognized injury and causation.

What Happened in the Alleged September 2026 Harley-Davidson Cyberattack?

On September 10, 2026, Cl0p listed Harley-Davidson on its dark-web extortion site. Cybernews reported that Cl0p named Harley-Davidson as one of four companies that, in the group’s words, did not reach out to it, and that it posted a torrent link to the alleged data. Cl0p is known for large-scale data theft and extortion, including the 2023 MOVEit Transfer and Fortra GoAnywhere campaigns.

Researchers who examined the listed files reported directory names associated with PTC Windchill and what appeared to be Oracle application logs spanning about a decade. That suggests engineering, business or system data. It does not establish what personal information, if any, the files contain.

A company’s appearance on a leak site is not, by itself, confirmation of a successful breach. Reports also differ on whether this was true ransomware. Bloomberg Law’s report calls it a ransomware attack, while some cybersecurity outlets noted the listing did not show whether files were encrypted. It may be better described as an alleged data-theft and extortion incident.

Did Harley-Davidson Refuse to Pay a Ransom?

Bloomberg Law reported that the complaint describes data being leaked after Harley-Davidson allegedly declined to pay. These are the plaintiff’s allegations and Cl0p’s claims. No authenticated company account of any ransom communication has been published.

What Has Harley-Davidson Said?

A Harley-Davidson spokesperson told Cybernews the company was aware of the claims but was declining further comment. The company has not issued public breach notifications confirming that personal information was compromised. Silence is not an admission of liability. Harley-Davidson may dispute whether the data is authentic, whether personal information was exposed, whether its safeguards were reasonable and whether anyone suffered compensable harm.

What Is PTC Windchill and CVE-2026-12569?

PTC Windchill is enterprise software manufacturers use to manage product designs, engineering drawings, specifications and workflows across departments and suppliers. A compromise of such a system can expose commercially sensitive information.

In 2026, PTC disclosed a critical remote code execution vulnerability affecting Windchill and FlexPLM, tracked as CVE-2026-12569. It was added to CISA’s Known Exploited Vulnerabilities Catalog, and security researchers have linked the broader Cl0p Windchill campaign to this flaw.

Whether Cl0p used this vulnerability against Harley-Davidson has not been independently established. Proving that would require evidence about Harley-Davidson’s software versions, patching, access logs and forensic findings, which may emerge in discovery.

Was Employee or Customer Personal Information Stolen?

This is the most important unanswered question.

Information category	Verification status
Internal engineering and system files	Reported by researchers reviewing the alleged data
Oracle application logs	Reportedly observed by researchers
Employee names and contact details	Not established
Social Security numbers	Not established
Payroll or bank account information	Not established
Customer purchase information	Not established
Motorcycle financing records	Not established
Dealer records	Not established
Number of affected individuals	Unknown

The 270GB figure must not be described as 270GB of stolen Social Security numbers or customer records. Large corporate data sets often contain logs, technical files and documents unrelated to identifiable people.

Are Harley-Davidson Motorcycle Owners Affected?

There is no verified evidence that all Harley-Davidson owners or customers were affected. The named plaintiff is a former employee, so current and former employees have the most direct reason to monitor this case.

Buying or financing a Harley-Davidson does not automatically make you a class member or show your information was in the alleged data. Wait for verified notices and a court-approved class definition.

Is This the Same as the Earlier 2024 Harley-Davidson Hacking Claim?

No. In December 2024, a threat actor using the name “888” claimed on an underground forum to have obtained about 66,700 Harley-Davidson customer records. That was a separate, unverified claim. The September 2026 Cl0p claim concerns a different alleged incident. Neither should be confused with Harley-Davidson’s product defect, warranty or recall lawsuits.

Laws That May Apply to the Harley-Davidson Data Breach Lawsuit

Which laws apply depends on the claims pleaded, the data involved and where affected people live.

1. Negligence and Reasonable Data Security

Negligence requires a duty of care, breach, causation and damages. Evidence in data breach cases often includes the sensitivity of the data held, known risks, industry standards, patching and vulnerability management, access controls, employee training and the speed of detection and response. The standard is reasonable security under the circumstances, not perfect protection against every sophisticated attack.

2. Wisconsin Data Breach Notification Law, Wis. Stat. § 134.98

Wisconsin requires entities that know of an unauthorized acquisition of covered personal information to notify affected individuals within a reasonable time, not exceeding 45 days after learning of it. It also requires notice to consumer reporting agencies when more than 1,000 people are notified. The statute is limited to specified personal information, such as Social Security numbers and certain financial account data, and has exceptions where the acquisition does not create a material risk of identity theft or fraud. The statute also addresses how a violation may be used in civil claims. It does not mean every claimed hack triggers an automatic deadline.

3. Missouri Data Breach Law, Mo. Rev. Stat. § 407.1500

Because Sadler lives in Missouri, Missouri law may become relevant. It generally requires notice to affected Missouri residents without unreasonable delay after discovering a breach of personal information. It requires notice to the Missouri Attorney General and consumer reporting agencies when more than 1,000 residents are notified. It also has a risk-of-harm exception. Missouri’s Merchandising Practices Act, Mo. Rev. Stat. § 407.020, is another statute plaintiffs sometimes invoke.

4. Other State Laws, Including the California CCPA

All 50 states have breach notification laws, and the law that governs each person generally follows their state of residence. If class members include California residents, the California Consumer Privacy Act, Cal. Civ. Code § 1798.150, allows a private right of action for certain breaches of nonencrypted personal information caused by a failure to maintain reasonable security, with statutory damages of $100 to $750 per consumer per incident.

5. FTC Act Section 5

Section 5 of the FTC Act, 15 U.S.C. § 45, prohibits unfair or deceptive practices, and the FTC has used it against companies with unreasonable data security. There is no private right of action under Section 5, but it informs the standard of reasonable security.

6. SEC Cybersecurity Disclosure Rules

Harley-Davidson is publicly traded. Under SEC rules, public companies must generally disclose a material cybersecurity incident on Form 8-K, Item 1.05, within four business days after determining it is material, subject to limited delays. The trigger is materiality, not a hacker’s claim. This is a securities obligation and gives individuals no breach-notification rights.

7. Federal Credit Freeze Rights, Fair Credit Reporting Act

Under the Fair Credit Reporting Act, 15 U.S.C. § 1681c-1, as amended by the 2018 Economic Growth, Regulatory Relief, and Consumer Protection Act, consumers may place and remove security freezes with the three credit bureaus for free.

8. Class Action Fairness Act (CAFA)

Under 28 U.S.C. § 1332(d), federal courts have jurisdiction over class actions with at least 100 class members, more than $5 million in controversy and minimal diversity. This helps explain why a data breach case can be filed in federal court.

9. Federal Rule of Civil Procedure 23

A class can be certified only if it meets the Rule 23 requirements of numerosity, commonality, typicality and adequacy, plus the Rule 23(b) requirements. No class has been certified here.

Can You Sue Without Identity Theft? Article III Standing

Federal plaintiffs must show a concrete injury. In Clapper v. Amnesty International USA, 568 U.S. 398 (2013), the Supreme Court required that threatened harm be certainly impending. In Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), it held an injury must be concrete as well as particularized. In TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), it held that a mere risk of future harm does not by itself support damages standing, though the analysis can differ where the harm materializes or causes other concrete injury.

This case sits in the Seventh Circuit, which has been comparatively receptive to data breach plaintiffs. In Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015), it found standing based on a substantial risk of fraud and mitigation costs. In Dieffenbach v. Barnes & Noble, Inc., 887 F.3d 826 (7th Cir. 2018), it recognized certain data breach injuries. Even so, Sadler faces a threshold question: what personal data, if any, was actually taken and what concrete harm followed.

Related Articles

• EyeMed Data Breach Class Action Lawsuit 
• Live Nation Data Breach Class Action Lawsuit (Ramos) 
• Citizens Bank Second Data Breach 2026 Class Action 

How Much Money Could Harley-Davidson Data Breach Victims Receive?

No payment amount has been established. Many data breach class actions that settle include credit monitoring, reimbursement of documented out-of-pocket losses, lost-time payments and modest cash payments, but outcomes vary widely and nothing is guaranteed.

Compensation question	Current status
Approved class action settlement	No
Settlement fund	None
Guaranteed payout	None
Official claim form	None
Claim deadline	None
Court-certified class	No
Liability finding	None

Beware of sites that promise breach checks or ask for payment to register for compensation. A law firm’s investigation or intake form is not a court-authorized settlement claim.

What Should Harley-Davidson Employees and Customers Do Now?

1. Watch for official notices. Verify any breach notice through Harley-Davidson’s official channels, and do not open unfamiliar attachments or enter personal data through unverified links. Be alert to phishing that uses the Harley-Davidson name.
2. Review financial accounts. Report suspicious transactions to your bank or card issuer promptly.
3. Check your credit reports. U.S. consumers can get free reports at AnnualCreditReport.com.
4. Consider a free credit freeze. Request it separately from Equifax, Experian and TransUnion. It does not stop misuse of existing accounts.
5. Report identity theft. Use the FTC’s free recovery process at IdentityTheft.gov.
6. Preserve records. Keep employment records, notices, fraud reports and records of losses and time spent, which may matter if a class or settlement is later approved.

Harley-Davidson Data Breach Lawsuit Timeline

Date	Development
December 2024	Separate, unverified claim by threat actor “888” about customer records
2026	PTC discloses critical Windchill/FlexPLM vulnerability CVE-2026-12569
September 10, 2026	Cl0p lists Harley-Davidson on its leak site
September 2026	Cybernews reports claimed 270GB release; Harley-Davidson says it is aware of the claims and declines further comment
November 10, 2026	Roger Sadler files proposed class action in E.D. Wisconsin
November 11, 2026	Bloomberg Law reports the lawsuit
November 12, 2026	No class certification, settlement or liability finding

Frequently Asked Questions

Is Harley-Davidson facing a class action lawsuit in 2026?

Yes. Roger Sadler filed Sadler v. Harley-Davidson, Inc., No. 2:26-cv-02088, on November 10, 2026, in the Eastern District of Wisconsin.

Was Harley-Davidson hacked by Cl0p?

Cl0p claims it stole and published company data. Harley-Davidson said it is aware of the claims but has not confirmed their scope.

How much Harley-Davidson data was allegedly stolen?

About 270GB according to Cl0p and cybersecurity reporting. Harley-Davidson has not confirmed this.

Did hackers steal employee Social Security numbers?

That has not been publicly established.

Are Harley-Davidson motorcycle owners affected?

There is no verified finding that customers were affected. The named plaintiff is a former employee.

Who can join the class action?

No class has been certified. The proposed class definition must be confirmed from the complaint and later court orders.

Is there a Harley-Davidson data breach settlement or claim form?

No. No settlement, claim form, fund or deadline exists.

Has Harley-Davidson admitted negligence?

No.

Did the Windchill vulnerability cause the alleged breach?

The vulnerability is real and tied to Cl0p’s campaign, but its use against Harley-Davidson has not been independently established.

What happens next?

Harley-Davidson may answer or move to dismiss, followed possibly by discovery and a class certification motion.

What Happens Next in Sadler v. Harley-Davidson?

The case is at its earliest stage. Key questions include:

1. Whether the leaked files are authentic Harley-Davidson records.
2. Whether they contain personal information about employees or others.
3. How any unauthorized access occurred.
4. Whether Harley-Davidson maintained reasonable security.
5. Whether breach-notification duties were triggered.
6. Whether the plaintiff and proposed class members suffered concrete, recoverable injuries.
7. Whether the case can satisfy Rule 23.

The lawsuit is real, but the extent of the alleged data breach remains uncertain. The next material developments will be Harley-Davidson’s formal response and any evidence showing what information was actually exposed.

Sources and Legal References

1. Bloomberg Law, November 11, 2026, “Harley-Davidson Hit With Proposed Data Breach Class Action”: https://news.bloomberglaw.com/privacy-and-data-security/harley-davidson-hit-with-proposed-class-action-after-data-breach
2. Docket summary, Sadler v. Harley-Davidson, Inc., No. 2:26-cv-02088: https://docketnexus.com/case/sadler-v-harley-davidson-inc–wied-119138/
3. CourtListener docket: https://www.courtlistener.com/docket/75098439/sadler-v-harley-davidson-inc/
4. Cybernews, “Harley-Davidson breach claimed by Cl0p gang with 270GB internal data dump”: https://cybernews.com/news/harley-davidson-clop-data-breach-windchill-270gb/
5. Cyber Security News, “Harley-Davidson Alleged Breach”: https://cybersecuritynews.com/harley-davidson-alleged-breach/
6. SOCRadar, Harley-Davidson Clop listing: https://socradar.io/data-breach/harley-davidson-clop-ransomware-2026/
7. Red Hot Cyber, December 2024 “888” claim: https://www.redhotcyber.com/?p=112256
8. PTC Windchill/FlexPLM advisory: https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability
9. NIST NVD, CVE-2026-12569: https://nvd.nist.gov/vuln/detail/CVE-2026-12569
10. Wisconsin Statute § 134.98: https://docs.legis.wisconsin.gov/statutes/statutes/134/98
11. Wisconsin DATCP data breach guidance: https://datcp.wi.gov/Pages/Publications/IDTheftDataBreach607.aspx
12. Missouri Rev. Stat. § 407.1500: https://revisor.mo.gov/main/OneSection.aspx?section=407.1500
13. California Civil Code § 1798.150: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.150
14. FTC Act § 5, 15 U.S.C. § 45: https://www.law.cornell.edu/uscode/text/15/45
15. Fair Credit Reporting Act, 15 U.S.C. § 1681c-1: https://www.law.cornell.edu/uscode/text/15/1681c-1
16. Class Action Fairness Act, 28 U.S.C. § 1332(d): https://www.law.cornell.edu/uscode/text/28/1332
17. Federal Rule of Civil Procedure 23: https://www.law.cornell.edu/rules/frcp/rule_23
18. SEC cybersecurity disclosure rules: https://www.sec.gov/newsroom/press-releases/2023-139
19. CFPB credit freeze guidance: https://www.consumerfinance.gov/ask-cfpb/what-is-a-credit-freeze-or-security-freeze-on-my-credit-report-en-1341/
20. FTC IdentityTheft.gov: https://www.identitytheft.gov/
21. AnnualCreditReport.com: https://www.annualcreditreport.com/
22. Clapper v. Amnesty International USA, 568 U.S. 398 (2013)
23. Spokeo, Inc. v. Robins, 578 U.S. 330 (2016)
24. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)
25. Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015)
26. Dieffenbach v. Barnes & Noble, Inc., 887 F.3d 826 (7th Cir. 2018)

Research and verification note: The filing, case number and plaintiff were confirmed through public docket records and Bloomberg Law. The full complaint was not independently available. The 270GB figure and Windchill connection come from cybersecurity reporting on Cl0p’s claims. No verified company disclosure identifying the affected population or exposed personal information was located. Statutory summaries should be checked against current statute text before relying on them.

Byline: AllAboutLawyer.com Legal Content Research Team

Last fact-checked: November 12, 2026

Legal disclaimer: This article provides general U.S. legal and consumer information, not legal advice. The allegations against Harley-Davidson have not been proven in court. No class has been certified, and no settlement benefits are available.