HackingHospitalityHospitalityData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHighContained

JC Resorts

bd_253b3923102e86fb · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 19, 2026

Filed

Apr 28, 2026

To disclose

14 weeks

Affected · nationwide

5,9421 in this filing

Linked

7 filings

Confidence

65%

Full breach record for JC Resorts →

JC Resorts LLC reported an external system breach on January 19, 2026, where an unauthorized actor viewed and copied files containing names and Social Security numbers. 5,942 individuals were affected, including 1 Maine resident. Notices were sent on April 28, 2026, offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 19, 2026 → Filed with AG Apr 28, 202699d ✗ ME AG >90d14 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 14 weeks / 99 days

Jan 19, 2026

Begins

Jan 19, 2026

Discovered

Apr 28, 2026

Filed

This filing is one of 7 about the same incident.View merged incident

A leak claim by qilin about this victim predates this filing by 99 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteqilinbd_120ae0978d45e0de2026-02-14 · +73dVerified by operator
Leak Siteqilinbd_edd06f07c59276f92026-01-19 · +99dVerified by operator

Regulatory filings (4) · sorted by filing gap

Nebraska State AGbd_475e4deee530a7832026-04-28Verified by operator
Indiana State AGbd_541e92e669c9efa72026-04-28Verified
Massachusetts State AGbd_7918dbaf98188e742026-04-28Verified by operator
California State AGbd_f42c4e2774364fa12026-04-28Verified

Name: JC Resorts
norm: jc resorts
Domain: jcresorts.com

Name: JC Resorts
norm: jc resorts
Domain: jcresorts.com
Industry: Hospitalityllm

Discovered: Jan 19, 2026
Breach occurred: Jan 19, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 28, 2026
Affected individuals: 5,942state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Providing written notice of this incident to relevant state regulatorsProviding written notice to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Initial access: external_remote_services

During the incident: Launched a response with assistance from outside cybersecurity specialists
Notified federal law enforcement
Providing access to credit monitoring services for twenty-four (24) months through Experian
Changes made: Implementing additional safeguards and training to its employees
Reviewing and further enhancing protections
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(99 days from discovery to filing)
Compliance flags: ME AG >90d · 99dLeak >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 19, 2026
→ Filed with AG: Apr 28, 2026
99d 90 days ME AG >90d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 19, 2026 → Filed with AG: Apr 28, 2026	99d	90 days	ME AG >90d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Nebraska State AGApr 28 · first

Indiana State AGApr 28 · first

Massachusetts State AGApr 28 · first

California State AGApr 28 · first

Maine State AGApr 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d72862fb-5b7c-4e43-9d8d-37bdffcba7cb.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 28, 2026
Raw hash: a83a42d2833265b6af81cf5c26307a7f2706fa962b9af91d5d63bfc59340db25

Linked disclosures

Ransomware claims (2)

Regulatory filings (4) · sorted by filing gap

Reporting entityJC Resorts

Victim entityJC Resorts

Incidentdiscovered Jan 19, 2026

Stated responseLaunched a response with assistance from outside cybersecurity specialists

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov