MalwareHospitalityHospitalityRansomwareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Beach Properties

bd_0d756c965855eb42 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 20, 2025

Filed

Apr 21, 2026

To disclose

26 weeks

Affected

40state residents only

Linked

6 filings

Confidence

66%

Full breach record for Beach Properties →

Basin Harbor Resort (Beach Properties) experienced a ransomware attack on October 20, 2025, resulting in unauthorized access and exfiltration of data. The incident affected 40 New Hampshire residents, whose personal information included names, Social Security numbers, driver's license numbers, and passport numbers. The resort engaged forensic investigators, secured its network, and notified affected individuals via mail on April 20, 2026, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 26 weeks / 183 days

Oct 20, 2025

Begins

Oct 20, 2025

Discovered

Apr 21, 2026

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_047d84a63ff834782026-04-21Verified
Massachusetts State AGbd_25f1afa48e1b70da2026-04-21Verified
Vermont State AGbd_83680b8d3cfa5fa22026-04-22 · +1dVerified
Indiana State AGbd_11044d5332cedf1d2026-04-20 · +1dCandidate

Show 1 more filing ↓up to 1d gap

Nebraska State AGbd_c1d2e5d81ca58dd62026-04-20 · +1dVerified

Name: Beach Properties
norm: beach properties

Name: Beach Properties
norm: beach properties
Also named: Beach Propertiesdba oflegal entity
Basin Harbor Resortdba oftrade name
Industry: Hospitalityllm

Discovered: Oct 20, 2025
Breach occurred: Oct 20, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 20, 2026
Affected individuals: 40state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Reported to New Hampshire Attorney General

During the incident: Took immediate action to secure the network environment
Engaged Kennedys law firm
Engaged CFC-Response, a cyber forensics specialist firm, to conduct an investigation
Engaged in a data mining process to identify personal information
Engaged in contact information research to affect written notification
Ran a national-change-of-address (NCOA) search to verify contact information
Notified 40 New Hampshire residents via U.S. mail
Offered 12 months of complimentary credit monitoring and identity protection services through TransUnion
Set up a professional call center through TransUnion to assist notified individuals
Changes made: Reviewing its existing security policies and protections
Adopting additional security to safeguard against evolving threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(183 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGApr 20 · first

Nebraska State AGApr 20 · first

Maine State AG+1d

Massachusetts State AG+1d

New Hampshire State AG+1d · this page

Vermont State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/beach-properties-basin-harbor-resort-20260421.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 21, 2026
Raw hash: 8c9af7b51b0e30445fc977f7433111f3d6a6f154f9549b25c58310d497ea6aad

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBeach Properties

Victim entityBeach Properties

Incidentdiscovered Oct 20, 2025

Stated responseTook immediate action to secure the network environment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov