Belkorp Ag, a leading California-based agricultural equipment dealer, experienced a major data breach. On or about April 26, 2025, the company detected suspicious activity within its network. An investigation determined that a cybercriminal gained access between April 18, 2025 and April 26, 2025, and copied sensitive data.
On May 20, 2025, a threat actor known as “hensi” claimed responsibility for the attack on openweb forums, alleging to have obtained the company’s complete network data, full database, over 1,000 PDF employee forms containing Social Security numbers, and budget information spanning 2015 to 2025.
A review was launched and on Sept. 2, 2025 revealed that the cyberattack compromised personally identifiable information (PII). Exposed information included names, Social Security numbers, dates of birth, driver’s license numbers, passport numbers, financial account information, biometric data, medical record numbers, health insurance coverage information, payment for health services, medical diagnosis and treatment information, and dates of treatment.
Belkorp AG began notifying affected individuals by mail on Sept. 29, 2025. The breach was officially disclosed to multiple state authorities, including the California Attorney General, Massachusetts Attorney General and New Hampshire Attorney General on Sept. 29, 2025.
The company also posted a Notice of Data Breach on its website.
Belkorp Ag responded to the cyberattack by, securing its systems and notifying law enforcement. In addition to required state and federal disclosures, the company is offering impacted individuals free IDX credit monitoring services.
If you receive a notice from Belkorp Ag about this breach, you may want to:
Belkorp Ag also established a dedicated assistance line for individuals with questions at 1-833-788-9712, available Monday through Friday from 6 a.m. to 6 p.m. Pacific Time.
More information about the company can be found on the Belkorp Ag website.
A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.
This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.