MalwareHospitalityHospitalityRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Beach Properties

bd_c1d2e5d81ca58dd6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 20, 2025

Filed

Apr 20, 2026

To disclose

—

Affected

3state residents only

Linked

6 filings

Confidence

66%

Full breach record for Beach Properties →

Beach Properties d/b/a Basin Harbor Resort reported a ransomware attack to the Nebraska AG on April 21, 2026. The incident, discovered on October 20, 2025, involved unauthorized access and exfiltration of personal information (names, SSNs, driver's license numbers) affecting 3 Nebraska residents. The resort engaged forensic investigators, secured its network, and provided 12 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Oct 20, 2025

Begins

Oct 20, 2025

Discovered

Apr 20, 2026

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_11044d5332cedf1d2026-04-20Candidate
Maine State AGbd_047d84a63ff834782026-04-21 · +1dVerified
New Hampshire State AGbd_0d756c965855eb422026-04-21 · +1dVerified
Massachusetts State AGbd_25f1afa48e1b70da2026-04-21 · +1dVerified

Show 1 more filing ↓up to 2d gap

Vermont State AGbd_83680b8d3cfa5fa22026-04-22 · +2dVerified

Name: Kennedys CMK LLP
norm: kennedys cmk

Name: Beach Properties
norm: beach properties
Also named: Beach Propertiesdba oflegal entity
Basin Harbor Resortdba oftrade name
Industry: Hospitalityllm

Discovered: Oct 20, 2025
Breach occurred: Oct 20, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 20, 2026
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Engaged law firm, as well as CFC-Response, a cyber forensics specialist firm, to conduct an investigation
Secured the network environment
Engaged in a data mining process to identify personal information
Engaged in contact information research
Notified three (3) Nebraska residents via U.S. mail
Offered 12 months of complimentary credit monitoring and identity protection services through TransUnion
Set up a professional call center through TransUnion
Changes made: Reviewing its existing security policies and protections
Adopting additional security to safeguard against evolving threats
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGApr 20 · first

Nebraska State AGApr 20 · first · this page

Maine State AG+1d

New Hampshire State AG+1d

Massachusetts State AG+1d

Vermont State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/6ede0a1c-d004-44e1-bfa8-7e9f183a32f8.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 20, 2026
Raw hash: c1cc2e922ebab98ccd98e7d005472e84c3f042a1b29faae3e24a45cf86c96b15

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityKennedys CMK LLP

Victim entityBeach Properties

Incidentdiscovered Oct 20, 2025

Stated responseEngaged law firm, as well as CFC-Response, a cyber forensics specialist firm, to conduct an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov