Eau Palm Beach Resort & Spa Listed by play Ransomware Group

On September 9, 2025, the Play ransomware group added the Eau Palm Beach Resort & Spa to its public leak site, claiming that internal files had been exfiltrated from the Florida luxury hotel during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates the resort’s data appeared on the Play group’s onion site with samples of allegedly stolen documents. The exact number of people affected remains unknown, as neither the resort nor the attackers have released a full victim count. Available reporting describes the exposed material as internal files, though the complete inventory has not been independently verified. The incident follows the group’s typical pattern of posting proof of exfiltration after an initial encryption attempt.

Why This Matters for You and Your Family

When a hotel you or your family has stayed at loses control of internal files, the information that leaks can include names, addresses, phone numbers, email addresses, dates of birth, payment details, and reservation notes. These records often contain enough personal data to fuel identity theft, phishing campaigns, or fraudulent accounts opened in your name. For families, a single breach can expose both parents and children if shared contact or loyalty-program information was stored together. The breach also highlights how everyday travel choices can place your household data in systems that are not always built with the same security expectations you apply at home.

The Doxxing and Identity-Chain Risk

Stolen hotel records rarely stay isolated. Attackers and data brokers routinely combine reservation details with other leaked sources to build detailed profiles. An email address from one breach can be linked to a username on a child’s gaming account; a phone number can tie that profile to social-media handles and physical addresses. Once these connections exist, targeted doxxing, swatting, or account takeovers become far easier. Credential leaks like this one frequently cascade into gaming-platform compromises because children often reuse simplified passwords across hotel Wi-Fi sign-ups, app registrations, and online games.

Play Ransomware Group’s Track Record

Public reporting attributes the Play ransomware group’s emergence to mid-2022. The group has since listed hundreds of organizations across multiple countries, with notable prior victims including financial firms, manufacturers, and hospitality companies. Their standard playbook begins with initial access through phishing or exploited remote-desktop services, followed by exfiltration of sensitive files before encryption. They then demand ransom and, if unpaid, publish proof packages on their leak site while threatening full data release. The group’s extortion style relies on public pressure rather than solely on encryption, making timely awareness critical for anyone whose information may have been taken.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains exist from this claimed breach.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your family’s data is caught in hours rather than months.
• Rotate any password you used for the resort’s Wi-Fi, loyalty program, or reservation portal anywhere it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next link in doxxing chains after credential leaks like this one.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to chase every copy of your information manually.

The incident at Eau Palm Beach Resort & Spa is a reminder that your personal data travels farther than you realize and can surface in unexpected places long after a vacation ends. Taking deliberate steps now limits how far any single breach can reach. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control before the next leak appears.