Mazda reports limited data exposure in warehouse system cyber incident

Mazda Motor Corporation, a Japan-based automotive manufacturer, disclosed that employee and business partner information was exposed in a cybersecurity incident identified in December 2025 after attackers exploited a vulnerability in a warehouse management system tied to parts procurement from Thailand.

The company confirmed that unauthorized external access was detected in a system used for warehouse operations. An internal investigation found that 692 records were potentially exposed. The affected data includes user IDs, full names, email addresses, company names and business partner identification numbers.

Mazda stated that the compromised system did not contain any customer data. The company has not identified any evidence that the exposed information has been misused.

Upon discovering the incident, Mazda reported the matter to Japan’s Personal Information Protection Commission, an agency within the Cabinet Office, and initiated an investigation with support from an external cybersecurity specialist. The company also implemented additional safeguards, including reducing internet exposure of systems, applying security patches, strengthening monitoring for suspicious activity and enforcing stricter access controls.

Mazda, one of Japan’s largest automakers, produces approximately 1.2 million vehicles annually and generates nearly $24 billion in revenue. The company operates globally with a broad network of suppliers and business partners.

Affected individuals have been advised to remain alert to potential phishing attempts or scams that could leverage the exposed information.

No ransomware group has publicly claimed responsibility for the incident.