{
  "id": "kalahari-employee-data",
  "url": "https://ohshit.app/incidents/kalahari-employee-data/",
  "title": "Kalahari employee data may have been exposed after network intrusion",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-09",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Kalahari",
    "employee data",
    "data breach"
  ],
  "ecosystems": [],
  "summary": "Kalahari says an unauthorized party accessed its network and may have affected current or former employees’ personal data. Its notice includes names, addresses, dates of birth and Social Security numbers. Texas lists 13,319 affected residents.",
  "splash": "Current and former employees notified by Kalahari.",
  "wipe": "Verify the notice, use its 12-month credit-monitoring offer, and review your credit if your data was affected.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify the letter and your affected data",
      "hint": "Use a known Kalahari employee contact or compare the mailed letter with the official California sample. Keep enrollment codes and personal data private."
    },
    {
      "title": "Use the offer and review credit activity",
      "hint": "The notice offers 12 months of single-bureau monitoring through Cyberscout. Follow the verified letter’s instructions and deadline. Review credit reports and statements. Consider freezing credit at all three national bureaus if your Social Security number was involved."
    }
  ],
  "sources": [
    {
      "name": "California Attorney General breach list",
      "url": "https://oag.ca.gov/privacy/databreach/list",
      "says": "Dates public listing to November 9.",
      "primary": true
    },
    {
      "name": "Kalahari employee notice filed in California",
      "url": "https://oag.ca.gov/system/files/Kalahari%20Notification%20Letter%20%28CA%29_Redacted.pdf",
      "says": "Describes the incident, employee population, potential data types and 12-month credit monitoring.",
      "primary": true
    },
    {
      "name": "Texas Attorney General public register",
      "url": "https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage",
      "says": "Lists 13,319 Texas residents and state-level data categories.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Kalahari confirms unauthorized network access and possible employee data exposure.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 9, 2026",
      "title": "Kalahari detects unauthorized network access",
      "body": "The company retains external security experts to secure the network and investigate."
    },
    {
      "date": "Oct 16, 2026",
      "title": "Investigation identifies possible personal-data impact",
      "body": "Kalahari reviews what information could have been involved and whom it relates to."
    },
    {
      "date": "Nov 9, 2026",
      "title": "California lists the employee notice",
      "body": "The public sample is dated October 30 and describes affected data and monitoring."
    },
    {
      "date": "Nov 10, 2026",
      "title": "Texas publishes its state count",
      "body": "Texas lists 13,319 affected Texans and notices sent by U.S. mail."
    }
  ],
  "body_markdown": "Kalahari says the October 9 network intrusion led to an October 16 determination that personal information may have been affected. The sample addressed to employees lists a date of birth among the possible fields. The Texas public row lists names, addresses and Social Security numbers. The state figure covers Texans. Kalahari did not describe the access path or say whether data was copied, and the notice reports no evidence of specific misuse at the time it was written."
}