Ober Mountain (OberGatlinburg.com) Listed by fog Ransomware Group

On December 26, 2024, the Ober Mountain resort operator OberGatlinburg.com appeared on the leak site of the fog ransomware group after 14.3 GB of internal files were allegedly exfiltrated in a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates that fog actors listed the Tennessee-based attraction, best known for its ski slopes, aerial tramway, and family entertainment venues. The posted data totals 14.3 GB of internal files. No exact count of individuals affected has been released, but the breach involves documents that can contain employee, vendor, customer, and partner information. The incident follows the typical ransomware pattern of initial access, data theft, and subsequent extortion pressure.

Available details state the listing occurred on a dark-web leak site monitored by ransomware trackers. OberGatlinburg.com has not yet issued a public statement on the volume or exact contents, which is common while incident response and legal review continue.

Why This Matters for You and Your Family

When a family-oriented destination like Ober Mountain suffers a breach, your personal information may be among the records now circulating. Ticket purchases, season-pass applications, loyalty-program sign-ups, ski-school registrations, and lodging reservations often include names, addresses, phone numbers, email addresses, dates of birth, and payment details. If you or your children have visited in the past decade, one or more of those records could be inside the 14.3 GB archive.

Once that information leaves the company’s control, it never truly returns. It can be sold, traded, or used to build profiles that make every member of your household an easier target for identity theft, phishing, or physical stalking. Children’s records are especially concerning because minors rarely monitor their own digital footprint.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently contain more than names and emails. They can link your real identity to usernames, passwords, phone numbers, and even notes about family members. Attackers chain these fragments together: an email from the breach is tested against gaming platforms, social-media accounts, and school portals. A single reused password can hand over your child’s Roblox, Fortnite, or Minecraft account in minutes. From there, doxxing escalates quickly—home address, parents’ names, and photos become public.

Credential leaks like this one cascade into account takeovers and doxxing chains that cross platforms most families never consider connected. What begins as a resort database can end with harassment on Discord or threats delivered to your doorstep.

Fog Ransomware Group Track Record

Public reporting attributes the attack to the fog ransomware group, which emerged in 2024. The gang has targeted hospitals, municipalities, manufacturers, and hospitality organizations. Its publicly known playbook involves stealthy initial access, often through compromised remote-desktop credentials or phishing, followed by rapid exfiltration of sensitive files. After stealing data, fog typically demands payment and, if unpaid, publishes samples or the full archive on its leak site to increase pressure. The group’s rapid rise and focus on mid-sized organizations match the Ober Mountain incident.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the included cleanup of data-broker records tied to the breach.
• Rotate any password you ever used on OberGatlinburg.com or related sites and enable 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your family’s information is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and emails exposed in incidents like this.
• Let remediation specialists handle takedown requests for any personal documents already appearing on paste sites or data-broker listings connected to the Ober Mountain files.

The fog listing of Ober Mountain is a reminder that even a single visit to a resort can leave your family’s information exposed for years. Acting quickly on the credentials and links revealed in this claimed breach can limit the damage before criminals stitch the pieces into a complete profile. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children’s gaming accounts.