Appleton Harley-Davidson Breach Put 18,628 Customer Records at Risk

When a motorcycle dealership suffers a data breach, it might not seem like the end of the world. But for the 18,628 customers of Appleton Harley-Davidson whose personal information was exposed in November 2024, the consequences are very real. Phishing emails, spoofed customer service calls, and targeted social engineering campaigns become far easier for criminals when they already know your name and email address. That is exactly what this breach enables.

Why This Is Dangerous

Dealerships collect and retain customer data for years, often without the same level of security investment as larger enterprises. A customer list with verified names and email addresses is a ready-made target list for phishing campaigns. Criminals do not need passwords to do damage with this data — they just need a convincing email.

What Was Exposed

• Email addresses
• First names
• Last names

A total of 18,628 customer records were exposed in what appears to be a direct dump from a customer database or CRM system. No passwords were included in this breach.

Why This Matters

The absence of passwords does not make this breach harmless. Threat actors who obtain verified email and name combinations can:

• Craft highly convincing spear-phishing emails that appear to come from the dealership itself
• Build customer profiles by cross-referencing with other breached datasets to enable identity fraud
• Execute business email compromise (BEC) attacks targeting dealership staff or vendors using customer data as cover
• Sell the list as a verified email dataset to spam networks, leading to long-term inbox compromise

How a Database Breach Works

For small and mid-sized businesses like dealerships, database breaches most commonly stem from unpatched software vulnerabilities, poorly secured CRM integrations, or third-party vendor compromises. Customer data collected through service appointments, loyalty programs, or online inquiries often sits in systems that receive minimal ongoing security attention. Once exfiltrated, the data is listed on dark web marketplaces where it is sold to anyone willing to pay — often within days of the breach occurring.

Check If You Are Affected

If you purchased from or interacted with Appleton Harley-Davidson, your name and email address may already be in the hands of bad actors. Use Heroic's breach search engine — powered by over 400 billion leaked records — to check whether your email address has been exposed in this or any other breach.

Search Heroic's 400B+ Record Database Now