MalwareHospitalityHospitalityRansomwareData ExfiltratedCustomer Data InvolvedRansom DemandedIdentity (basic)Government IDHighContained

Beach Properties

bd_047d84a63ff83478 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 20, 2025

Filed

Apr 21, 2026

To disclose

26 weeks

Affected · nationwide

3,15021 in this filing

Linked

6 filings

Confidence

66%

Full breach record for Beach Properties →

Beach Properties d/b/a Basin Harbor Resort reported a ransomware attack on October 20, 2025, resulting in unauthorized access and exfiltration of personal information, including names and Social Security numbers. The incident affected 3,150 individuals total, including 21 Maine residents. Notifications were sent on April 20, 2026, offering 12 months of credit monitoring via TransUnion.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 20, 2025 → Filed with AG Apr 21, 2026183d ✗ ME AG >90d26 weeks discovery → filing

Incident timeline

discovery → filing · 26 weeks / 183 days

Oct 20, 2025

Begins

Oct 20, 2025

Discovered

Apr 21, 2026

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_0d756c965855eb422026-04-21Verified
Massachusetts State AGbd_25f1afa48e1b70da2026-04-21Verified
Vermont State AGbd_83680b8d3cfa5fa22026-04-22 · +1dVerified
Indiana State AGbd_11044d5332cedf1d2026-04-20 · +1dCandidate

Show 1 more filing ↓up to 1d gap

Nebraska State AGbd_c1d2e5d81ca58dd62026-04-20 · +1dVerified

Name: Kennedys CMK LLP
norm: kennedys cmk

Name: Beach Properties
norm: beach properties
Also named: Beach Propertiesdba oflegal entity
Basin Harbor Resortdba oftrade name
Industry: Hospitalityllm

Discovered: Oct 20, 2025
Breach occurred: Oct 20, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 20, 2026
Affected individuals: 3,150state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported to Maine Attorney General Office

During the incident: Engaged Kennedys CMK LLP as counsel
Engaged CFC-Response, a cyber forensics specialist firm, to conduct an investigation
Secured the network environment
Engaged in a data mining process to identify personal information
Engaged in contact information research
Ran a national-change-of-address (NCOA) search
Notified affected individuals via U.S. mail
Offered 12 months of complimentary credit monitoring and identity protection services through TransUnion
Set up a professional call center through TransUnion
Changes made: Reviewing existing security policies and protections
Adopting additional security to safeguard against evolving threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(183 days from discovery to filing)
Compliance flags: ME AG >90d · 183dME resident >180d · 182d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 20, 2025
→ Filed with AG: Apr 21, 2026
183d 90 days ME AG >90d
Maine
Discovered: Oct 20, 2025
→ Notified: Apr 20, 2026
182d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 20, 2025 → Filed with AG: Apr 21, 2026	183d	90 days	ME AG >90d
Maine	Discovered: Oct 20, 2025 → Notified: Apr 20, 2026	182d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGApr 20 · first

Nebraska State AGApr 20 · first

New Hampshire State AG+1d

Massachusetts State AG+1d

Maine State AG+1d · this page

Vermont State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d3a6a1b1-aa0a-4b73-b733-1d35ce0fc888.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 21, 2026
Raw hash: 3d1ca7158b5a8d7accfafb941fb75e9631e83a31d29634b1aeb98f7cb94422d5

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityKennedys CMK LLP

Victim entityBeach Properties

Incidentdiscovered Oct 20, 2025

Stated responseEngaged Kennedys CMK LLP as counsel

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov