CMHHELI.COM Listed by Clop Ransomware Group

On February 7, 2026, the Clop ransomware group added CMHHELI.COM to its public leak site, claiming that internal files from Canadian Mountain Holidays Heli-Skiing & Summer Adventures had been exfiltrated.

Reported Details of the Breach

Public reporting indicates the Canadian travel company, which has offered luxury heli-skiing and summer adventure packages in British Columbia since 1965, was compromised in a ransomware incident. The attackers claim to have stolen internal files although the exact volume and specific types of data remain unclear. No customer count has been disclosed, and the company has not yet issued a public statement detailing what records were taken. The listing appeared on the Clop leak site hosted on the dark web, a common tactic used to pressure victims into payment.

Why This Matters for You and Your Family

If you have ever booked a heli-skiing trip, summer adventure package, or stayed at one of CMH’s lodges, your personal information may now sit in a ransomware operator’s hands. Travel companies routinely collect names, home addresses, phone numbers, email addresses, dates of birth, passport details, and payment information. When such records are stolen, identity thieves can open accounts in your name, file fraudulent tax returns, or sell the details to others who target you with phishing emails that look legitimate because they reference your actual booking history. For families, the risk multiplies: one parent’s booking can expose every traveler listed on the reservation, including children.

The Doxxing and Identity-Chain Risks

Stolen travel data rarely stays isolated. A single email or phone number from the CMH files can be cross-referenced with gaming accounts, social-media handles, and data-broker records to build a complete profile. Attackers then move from identity theft to doxxing, publishing addresses, family member names, and even children’s usernames so others can harass or impersonate them. Credential leaks like this one frequently cascade into account takeovers on gaming platforms because families often reuse passwords across travel bookings and children’s Xbox, PlayStation, or Roblox accounts. Once an attacker controls a child’s gaming profile tied to the family address, the doxxing chain becomes far more damaging.