On November 23, 2025, the tengu Ransomware Group added Coral Clubes - Mexico to its public leak site, claiming that it had exfiltrated internal files from The Fimex Group, the operator of luxury leisure and sports clubs focused on golf and integrated resorts.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Coral Clubes
Get alerted the next time Coral Clubes files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Coral Clubes’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates the incident stems from a ransomware attack in which attackers gained access to the company’s systems, encrypted data, and then exfiltrated files before publishing a sample on their leak portal. The Fimex Group has not yet issued a public statement confirming the breach or detailing the volume of data involved. Available reporting describes the exposed material as internal files, though the exact number of records or specific categories of customer information remain unconfirmed at this time. The listing appeared on the tengu leak site hosted via an onion address tracked by ransomware.live.
Why This Matters for You and Your Family
When a company that handles membership records, payment details, and personal contact information for leisure clubs suffers a breach, the consequences reach ordinary families who simply signed up for a golf membership or family resort package. Internal files often contain names, addresses, phone numbers, email accounts, dates of birth, and payment card data. Once those details surface on a ransomware leak site, they become easy targets for identity thieves, phishing campaigns, and follow-on fraud. Your family’s information could be packaged and sold alongside thousands of other records, increasing the chance that someone will attempt account takeovers on your email, banking, or shopping accounts.
The Doxxing and Identity-Chain Implications
Leaked membership files frequently link real names and home addresses to email addresses, phone numbers, and sometimes even spouse or children’s names. Attackers and data brokers then chain these fragments together with information from other breaches. A single exposed golf-club record can reveal your child’s sports activity schedule or family travel patterns. This creates a roadmap for doxxing that moves from one platform to the next. Credential leaks like this one routinely cascade into gaming account takeovers, especially when families reuse passwords across leisure bookings and online games.