Aman Data Breach (2026)

On April 20, 2026, luxury hotel operator Aman became the latest victim in a ShinyHunters “pay or leak” extortion campaign. The attackers claimed to have stolen records on 216,000 customers from the company’s Salesforce CRM system. When Aman did not meet their demands, the group published the data, exposing names, email addresses, phone numbers, physical addresses, dates of birth, genders, nationalities, language preferences, spouse names, and VIP status codes for many of the records.

Reported Details of the Breach

Public reporting from Have I Been Pwned confirms that the dataset contains over 200,000 unique email addresses. Not every record holds every data field, yet the combination present is unusually rich. Physical addresses, phone numbers, dates of birth, and spouse names appear alongside VIP status markers that identify high-value guests. The breach originated inside Aman’s Salesforce customer relationship management platform, according to the attackers’ own statements. The data was first used as leverage in an extortion demand and then dumped publicly after the deadline passed.

Why This Matters for You and Your Family

When a hotel chain loses contact details, birth dates, home addresses, and family connections, the information becomes raw material for identity thieves, stalkers, and fraudsters. A single exposed phone number or spouse name can unlock further details through public records and social media. For families, the risk extends beyond the primary account holder. Children’s names sometimes appear in family bookings; their dates of birth sit alongside parental addresses. Once this data circulates on underground forums, it can fuel spear-phishing campaigns, account takeover attempts, and even physical security threats at your actual home. The luxury segment offers no protection—attackers deliberately target brands whose customers are perceived to hold higher balances or travel schedules that leave houses empty.

The Doxxing and Identity-Chain Risks

Credential leaks of this nature rarely stop at one company. Emails and phone numbers harvested from Aman can be cross-referenced with gaming accounts, social logins, and family-shared services. A child’s Roblox or Fortnite username linked to a parent’s breached email creates a direct path to doxxing. Attackers map these connections, then escalate from simple spam to targeted extortion or swatting. The presence of spouse names and VIP flags further enriches the profile, allowing criminals to impersonate family members with convincing personal details. Available reporting describes how such identity chains grow rapidly once the first node—here, an Aman reservation record—enters criminal marketplaces.

ShinyHunters’ Publicly Known Track Record

Public reporting attributes the Aman campaign to the group known as ShinyHunters. The collective first gained notoriety several years earlier through high-profile database sales and leaks. Notable prior victims include major consumer platforms and retailers where customer records were similarly exfiltrated and used for extortion. Their typical playbook begins with initial access to cloud-hosted CRM or marketing databases, followed by bulk exfiltration of personally identifiable information. They then contact the victim company with a ransom demand framed as “pay or leak,” set a short deadline, and publish the full dataset on leak sites when payment is not received. This pattern matches the publicly described events surrounding the Aman incident.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate the password used at Aman anywhere it is reused and immediately enable two-factor authentication through an authenticator app on every account sharing those credentials.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that chain back to the same address or email.
• Let remediation specialists perform hands-on takedown requests across data brokers and leak sites on your behalf.

The Aman breach demonstrates that even sophisticated brands can lose control of customer data with lasting consequences for ordinary families. A forward-looking approach requires both immediate password hygiene and ongoing visibility into how your information travels across the internet. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts—making it especially useful when credential leaks like this one cascade into account takeovers and doxxing chains.