Mitsubishi Auto Leasing: an attacker exploited a new flaw in its mobile device management server and 1,166 staff records, including password hashes, leaked

1. 2025-05-31

   It detected that an outside party had accessed its mobile device management server by exploiting a new flaw, and it fixed the flaw. [1]

2. 2025-08-08

   It announced the incident after an investigation firm found that staff data had leaked. [1] [2] [3]

The names, company email addresses and Windows password hashes for company PCs of 1,166 staff of the company and its contractors, who worked there from 2013 to 2025, leaked. No customer or partner data was involved, and no secondary harm has been confirmed. [1] [2]