Travel of America Listed by dragonforce Ransomware Group

On April 13, 2026, luxury travel company Travel of America appeared on the leak site of the dragonforce ransomware group. The company, which arranges high-end ocean, river, and expedition cruises as well as hotels, resorts, guided tours, and custom land packages, is claimed to have had internal files exfiltrated during a ransomware attack. While the exact number of affected individuals remains unknown, anyone who booked through the company, joined its loyalty program, or provided personal details for reservations could have information now in attackers’ hands.

What's Publicly Reported from Reporting

Public reporting indicates that Travel of America was listed on the dragonforce leak site on April 13, 2026. The data consists of internal files exfiltrated after a ransomware deployment. No confirmed total of records or specific customer count has been released. The company’s business focuses on premium travel experiences, meaning client records likely contain names, contact details, payment information, passport copies, travel itineraries, and loyalty program data.

Why This Matters for You and Your Family

When a travel company loses control of customer records, the fallout reaches ordinary families who saved for special trips. Your home address, phone number, email, date of birth, and payment card details can be sold or published. Children’s names sometimes appear in family booking files, creating long-term risks. Once this information reaches criminal marketplaces, it fuels identity theft, fraudulent bookings, and targeted scams that feel personal because attackers know exactly where you planned to travel and when.

The Doxxing and Identity-Chain Risks

Travel records often link your real identity to usernames, frequent-flyer numbers, and email addresses. Attackers can chain this data with information from other breaches to build a complete profile. A single leaked itinerary can expose your child’s gaming handle if the same email was used to register an account. These connections turn one breach into repeated harassment, account takeovers, and doxxing campaigns that follow your family across platforms.

Dragonforce’s Publicly Known Track Record

Public reporting attributes the dragonforce ransomware group with operations that emerged in recent years. The group typically gains initial access through common vectors such as phishing or exploited remote desktop services, exfiltrates sensitive files before encrypting systems, and then posts samples on its leak site while demanding payment. Notable prior victims include organizations across multiple sectors, though specifics vary by incident. Their playbook relies on public pressure: they publish increasing amounts of stolen data until the target pays or the deadline passes.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, travel loyalty accounts, and real identity so you can see the exposure created by this claimed breach.
• Rotate any password you used on the Travel of America site or app anywhere else it is reused, and switch on two-factor authentication through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and your children’s gaming accounts, which often chain back to the same addresses and emails used for family travel bookings.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The Travel of America incident shows how quickly a vacation booking can become a permanent privacy problem. One breach can cascade into account takeovers and doxxing chains that affect every member of your household. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, hands-on remediation by specialists, and full family coverage that includes children’s gaming accounts. Starting protective action now limits the damage from this leak and from the ones that will inevitably follow.