HackingGovernment IDIdentity (basic)MediumContained

JC Resorts

bd_475e4deee530a783 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 19, 2026

Filed

Apr 28, 2026

To disclose

—

Affected

1state residents only

Linked

7 filings

Confidence

66%

Full breach record for JC Resorts →

JC Resorts LLC notified Nebraska AG of a breach discovered on January 19, 2026, involving unauthorized access to network files. One Nebraska resident was affected, with data including names and Social Security numbers. The company engaged outside cybersecurity specialists, notified federal law enforcement, and provided 24 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d

Incident timeline

Jan 19, 2026

Begins

Jan 19, 2026

Discovered

Apr 28, 2026

Filed

This filing is one of 7 about the same incident.View merged incident

A leak claim by qilin about this victim predates this filing by 99 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteqilinbd_120ae0978d45e0de2026-02-14 · +73dVerified by operator
Leak Siteqilinbd_edd06f07c59276f92026-01-19 · +99dVerified by operator

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_253b3923102e86fb2026-04-28Verified
Indiana State AGbd_541e92e669c9efa72026-04-28Verified
Massachusetts State AGbd_7918dbaf98188e742026-04-28Verified by operator
California State AGbd_f42c4e2774364fa12026-04-28Verified

Name: JC Resorts
norm: jc resorts
Domain: jcresorts.com

Name: JC Resorts
norm: jc resorts
Domain: jcresorts.com

Discovered: Jan 19, 2026
Breach occurred: Jan 19, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 28, 2026
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1119 Automated Collection
Threat actor: External
Regulator citations: providing written notice of this incident to relevant state regulators

During the incident: Launched a response with assistance from outside cybersecurity specialists
Notified federal law enforcement
Providing access to credit monitoring services for twenty-four (24), through Experian
Changes made: Working to implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGApr 28 · first

Indiana State AGApr 28 · first

Massachusetts State AGApr 28 · first

California State AGApr 28 · first

Nebraska State AGApr 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/522e22d5-62f8-458a-b823-3114b887c0a8.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 28, 2026
Raw hash: 7308e6270220a8b802d82407f6509cee3994b7fdfdfef4a0db8da70f99fc0e18

Linked disclosures

Ransomware claims (2)

Regulatory filings (4) · sorted by filing gap

Reporting entityJC Resorts

Victim entityJC Resorts

Incidentdiscovered Jan 19, 2026

Stated responseLaunched a response with assistance from outside cybersecurity specialists

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancenebraska.gov