---
title: "Kalahari employee network-data incident"
description: "Kalahari reported unauthorized network access and possible exposure of current and former employees’ personal information."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-12"
canonical_url: "https://www.ally.security/incidents/kalahari-employee-network-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/kalahari-employee-network-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/kalahari-employee-network-data-incident-2026/stix.json"
---

# Kalahari employee network-data incident

Kalahari reported unauthorized network access and possible exposure of current and former employees’ personal information.

Last modified Nov 12, 2026 · 1 source

## Summary

- **Environment:** Kalahari network and employee information
- **Operational impact:** Possible employee-data exposure; outage scope not disclosed
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Kalahari Management](https://www.kalahariresorts.com/) detected unauthorized network access October 9, 2026. On October 16 it determined that personal information may have been affected. Notices went to current and former employees of Kalahari companies. [1](#source-1)

## Impact

Potentially involved fields included names, addresses, birth dates and Social Security numbers. The October 30 letter reported no known specific misuse or related identity theft. It did not provide an affected-person count. [1](#source-1)

## Timeline

### October 9, 2026 — Network access detected

Kalahari engaged specialists to secure its network. [1](#source-1)

### October 16, 2026 — Possible data impact determined

The investigation identified possible personal-information exposure. [1](#source-1)

### October 30, 2026 — Employee letter issued

The [notification](https://oag.ca.gov/system/files/Kalahari%20Notification%20Letter%20\(CA\)_Redacted.pdf) described the potential data categories. [1](#source-1)

### November 12, 2026 — Briefing updated

This briefing was last reviewed and updated on November 12, 2026.

## Threat Group & Attack Vector

The notice confirms unauthorized access but does not establish how the intruder entered or whether information was removed.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific ATT\&CK technique is mapped from the available evidence.

## Response

Kalahari investigated with cybersecurity experts, added security safeguards and reviewed its policies and procedures. It offered 12 months of credit monitoring. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/kalahari-employee-network-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Kalahari employee data-breach notification

official · Kalahari Management Co. LLC · Oct 30, 2026

<https://oag.ca.gov/system/files/Kalahari%20Notification%20Letter%20(CA)_Redacted.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Employee notification issued: 2026-10-30
2. **Occurred At · 100% confidence · current**  
   Unauthorized network access detected: 2026-10-09
3. **Discovered At · 100% confidence · current**  
   Kalahari employee network-data incident: 2026-10-09
4. **Disclosed At · 100% confidence · current**  
   Kalahari employee network-data incident: 2026-10-30
5. **Resulted In · 100% confidence · current**  
   Kalahari employee network-data incident: Employee notification issued
6. **Resulted In · 100% confidence · current**  
   Kalahari employee network-data incident: Possible personal-data impact determined
7. **Resulted In · 100% confidence · current**  
   Kalahari employee network-data incident: Potentially involved information included names, addresses, dates of birth and Social Security numbers. Kalahari reported no evidence of specific misuse or related identity theft as of its October 30 letter. No total was provided.
8. **Affected Organization · 100% confidence · current**  
   Kalahari employee network-data incident: Kalahari Management Co. LLC
9. **Resulted In · 100% confidence · current**  
   Kalahari employee network-data incident: Kalahari detected unauthorized network access October 9 and determined October 16 that personal information may have been affected. Notices concern current and former employees of Kalahari companies.
10. **Occurred At · 100% confidence · current**  
   Possible personal-data impact determined: 2026-10-16
11. **Resulted In · 100% confidence · current**  
   Kalahari employee network-data incident: Unauthorized network access detected
12. **Resulted In · 100% confidence · current**  
   Kalahari employee network-data incident: Kalahari engaged cybersecurity experts, secured its network, investigated the scope, added safeguards and reviewed security policies. It offered 12 months of credit monitoring.

</details>