Copamarina Beach Resort Listed by The Gentlemen Ransomware Group

On February 15, 2026, the ransomware group known as thegentlemen added Copamarina Beach Resort to its public leak site, claiming that internal files had been exfiltrated from the Puerto Rico oceanfront hotel’s systems.

What Public Reporting Shows

Public reporting indicates the resort’s domain copamarina.com appeared on the group’s onion site hosted at tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion. The listing states that internal files were stolen during a ransomware incident. No exact victim count has been published, and the precise volume or sensitivity of the documents remains unclear from available screenshots and summaries. The breach notice lists both the resort’s primary website and a ZoomInfo business profile, suggesting the attackers may have cross-referenced publicly available corporate data with the stolen material.

Why This Matters for You and Your Family

When a hotel you or your family have stayed at loses internal files, the information exposed often includes guest details that feel deeply personal. Reservation records, email addresses, phone numbers, payment information, and sometimes scanned IDs or passport copies can appear in these dumps. Once that data reaches a ransomware leak site, it is freely available to identity thieves, stalkers, and scammers who target ordinary people rather than corporations. Any family vacation booking from the past several years could now link your home address to your travel history, making it easier for someone to build a profile on you.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one company. A single exposed email or phone number from a hotel reservation can be chained with credentials from earlier breaches, gaming accounts, or social-media handles. Attackers use these connections to locate family members, uncover children’s usernames on Roblox or Fortnite, and escalate from simple identity theft to full doxxing. Public reporting on similar incidents shows that credential leaks like this one frequently cascade into account takeovers across unrelated services. The risk is not abstract: once your information sits on a leak site, the window for preventive action narrows quickly.

Thegentlemen’s Publicly Known Track Record

Public reporting attributes thegentlemen with emerging in late 2024. The group has listed hospitality companies, local governments, and mid-sized businesses. Its typical playbook involves initial access through phishing or exploited remote desktop credentials, followed by claimed exfiltration of internal documents, deployment of ransomware, and then dual extortion: demanding payment to decrypt systems while simultaneously threatening to publish stolen files on its leak site. The group maintains a relatively low public profile compared with larger ransomware operations but consistently follows through on publishing data when victims do not pay.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what chains back to the Copamarina breach.
• Rotate any password you used when booking at Copamarina Beach Resort or any other hotel and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The incident is a reminder that your vacation photos and family memories now sit alongside data that criminals can weaponize. Starting with a clear map of your exposure and ongoing protection is the most practical defense available. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.