Cyber Incident Victim: Maine Course Hospitality Group
Timeline
Summary
Maine Course Hospitality Group reported a data breach after the ransomware group Qilin posted on the dark web that it had obtained the company's data. The breach may have exposed personal information such as Social Security numbers, government identification numbers, and health records. Edelson Lechtzin LLP has launched an investigation into the incident and is evaluating potential class action claims on behalf of affected individuals. The organization, a Maine‑based hotel owner and operator with roughly two dozen properties across the Northeast and Florida that include Marriott and Hilton brands, notified the Vermont Attorney General of the breach.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or about July 31, 2026, Maine Course Hospitality Group reported a data breach to the Vermont Attorney General. The company disclosed that, on November 5, 2025, the ransomware group Qilin had posted on the dark web claiming to possess data belonging to Maine Course Hospitality Group. The reported breach may have compromised personal information such as Social Security numbers, government identification numbers, and health records. Maine Course Hospitality Group is a Maine‑based hotel owner and operator that was founded in 1986 and operates approximately 24 properties across the Northeast and Florida, including locations branded as Marriott and Hilton. The timeline indicates that the attackers’ claim preceded the company’s public report by roughly eight months.
Individuals who received a data breach notification from Maine Course Hospitality Group may face an increased risk of identity theft and fraud due to the exposure of sensitive personal data. In response, the national class action law firm Edelson Lechtzin LLP announced an investigation into potential data privacy claims arising from the breach. The firm stated that it would evaluate the rights and possible claims of affected individuals at no cost and consider pursuing a class action lawsuit. Edelson Lechtzin LLP provided contact information for those wishing to speak with a data privacy attorney, including a phone number, email address, and office location. The firm also noted that it handles a range of class and collective actions beyond data breach litigation, such as securities fraud and wage theft claims.