https://www.lagoonpark.com/ Listed by embargo Ransomware Group

On March 31, 2026, Lagoon Amusement Park in Farmington, Utah, appeared on the embargo ransomware group’s leak site with 6 TB of internal files listed for public release.

What's Publicly Reported from Reporting

Public reporting indicates the historic family-owned park, operating since 1886, suffered a ransomware attack in which attackers exfiltrated internal documents before encrypting systems. The embargo group posted details of the breach on its dark-web leak portal, giving the park a short window to negotiate before full data publication. Available reporting describes the exposed material as a large volume of internal files totaling 6 TB, though the precise mix of personal information has not been independently verified by third parties. No official victim count has been released, leaving uncertainty about how many customers, employees, or vendors may be affected.

Why This Matters for You and Your Family

When a local business like Lagoon leaks customer records, the information can reach identity thieves, scammers, and harassers within hours of publication. If you or your family have visited the park, purchased season passes, entered contests, or joined loyalty programs, your names, addresses, phone numbers, email addresses, or payment details may now sit inside that 6 TB archive. Once posted on a ransomware leak site, the data spreads quickly across underground forums, increasing the chance of account takeovers, fraudulent tax filings, or targeted phishing aimed at your household.

Credential leaks from amusement-park systems often cascade into gaming accounts because families reuse passwords across entertainment services. A child’s Roblox, Fortnite, or Minecraft login tied to the same email can be hijacked, leading to in-game theft or further doxxing that reveals your home address.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at one dataset. They map relationships between emails, phone numbers, usernames, and family members to build saleable “fullz” profiles. A single leaked Lagoon record can link your amusement-park email to your child’s gaming handle, your spouse’s work account, and your home address. These identity chains accelerate doxxing campaigns in which attackers publish personal details on harassment forums or sell them to stalkers. Public reporting shows that amusement and hospitality breaches frequently feed long-term identity theft rings because families treat park logins as low-risk compared with banking credentials.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup of exposed records.
• Rotate any password you used for Lagoon accounts or season passes anywhere it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that chain back to the same address or email.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your own logins.

The incident underscores a simple reality: data stolen from everyday local businesses now travels the same underground paths as breaches at global corporations. Protecting your family requires more than changing one password. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage also safeguards children’s gaming accounts that often become the next link in a doxxing chain after credential leaks like this one. Starting proactive defense today limits how far any single breach can reach.