Kalahari Resorts

Summary

Kalahari Resorts disclosed a data breach affecting current and former employees after unauthorized access to its network was detected. The company notified attorneys general in California and Texas, identifying 13,319 affected Texas residents, and began sending written notices to affected individuals. INC Ransom claimed responsibility for the attack through its dark web site on the Tor network and stated it obtained organizational data. The investigation determined that names, addresses, dates of birth, and Social Security numbers were potentially exposed. The company is providing affected individuals with 12 months of free single-bureau credit monitoring, credit report, and credit score services through Cyberscout, a TransUnion company, and has established a dedicated help line for inquiries.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Kalahari Resorts & Conventions, a hospitality company that operates large indoor waterpark resorts across the United States, disclosed a data breach in October 2026 that affected current and former employees of the company. On Oct. 9, 2026, unauthorized access to the company's network was first detected. A subsequent investigation revealed that personal information was affected as a result of the incident. The company disclosed the breach to the attorneys general offices of California and Texas, with 13,319 Texas residents identified as affected. Kalahari began notifying affected individuals by written notice on Oct. 30, 2026. The notification letters were sent to inform individuals whose data may have been compromised during the network intrusion. The affected population consisted of workforce records maintained by the resort operator.

The ransomware group known as INC Ransom claimed responsibility for the attack on its dark web site hosted on the Tor network. The group claims to have obtained organizational data from Kalahari. The investigation determined that the types of personal information potentially exposed included names, addresses, dates of birth, and Social Security numbers. These data elements relate to current and former employees whose records were stored on the affected network.

The company is offering affected individuals 12 months of free single-bureau credit monitoring, credit report, and credit score services. These services are being provided by Cyberscout, a TransUnion company. To enroll, affected individuals can visit the Cyberscout activation page and enter the unique code provided in their notification letter. Enrollment must be completed within 90 days of the date of the letter. Kalahari has set up a dedicated help line at 1-855-711-7980. The help line is available Monday through Friday from 8 a.m. to 8 p.m. Eastern time, excluding holidays. Representatives are available for 90 days from the date of the notification letter to assist with questions about the incident.

Sources

Sources available to members: 1 source.