Gurney's Resorts Listed by akira Ransomware Group

On September 15, 2025, the Akira ransomware group listed Gurney's Montauk Resort & Seawater Spa on its leak site and announced plans to publish 20GB of stolen corporate data. The breach includes employees' passports, addresses, Social Security numbers, phone numbers, emails, and medical information, as well as client records containing dates of birth, full names, phone numbers, emails, room numbers, and addresses.

Reported Details from Public Reporting

Public reporting indicates the luxury resort in Montauk, New York, which operates 158 rooms, suites, and beachfront cottages, suffered a ransomware attack in which attackers exfiltrated internal files. The data set also contains finance and accounting documents and NDAs. Available reporting describes the exposed information as a mix of staff personal records and guest details collected during normal resort operations. No exact victim count has been released, and the precise date of initial compromise remains unconfirmed in current public sources.

20GB of corporate data is scheduled for release if the resort does not meet the group's demands. The leak site posting states the presence of passports, SSNs, medical information, and guest room numbers — details that can be used well beyond simple identity theft.

Why This Matters for You and Your Family

If you or any member of your family has stayed at Gurney's Montauk or worked there, your personal information may now sit on a ransomware leak site. A single exposed SSN or passport number can lead to new accounts opened in your name, tax fraud, or medical identity theft that appears on your insurance statements months later. Addresses and phone numbers make it easier for criminals to target you with phishing texts or calls that sound legitimate because they already know where you vacationed or worked.

Children listed on family reservations or employee records are not automatically protected. Their dates of birth combined with a parent's address can seed long-term identity files that surface when they turn 18 and apply for their first credit card or student loan.

The Doxxing and Identity-Chain Risk

Credential leaks of this type rarely stop at one company. Emails, passwords, and personal details exposed in the Gurney's incident can be cross-referenced with gaming accounts, social-media handles, and school records. Once attackers link an email to a child's Roblox or Fortnite username, they can pursue account takeovers that expose chat logs, friend lists, and sometimes home addresses shared during gameplay. These chains turn a hotel breach into persistent harassment or identity fraud that follows your family for years.

Akira Group's Publicly Known Track Record

Public reporting attributes the Akira ransomware group with emerging in 2023. The group has targeted organizations across healthcare, education, and hospitality sectors. Its typical playbook involves initial access through compromised credentials or remote desktop tools, followed by exfiltration of sensitive files before encryption. Akira then demands payment and, if unpaid, publishes samples or full datasets on its leak site to pressure victims. Past incidents show the group frequently posts employee and client personal information alongside financial records.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains back to the Gurney's breach.
• Rotate any password you used at Gurney's Resorts anywhere else it is reused, and switch on 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children's gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and suspicious sites while you focus on securing accounts and watching credit reports.

The Gurney's breach is a reminder that one resort stay or paycheck can hand criminals the starting point for years of trouble. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children's gaming accounts. Start your DoxxScan trial today to see where you stand and begin closing the gaps.