HackingCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICPHIMediumContained

Vacation Myrtle Beach

bd_fbb0b4436e2c347f · schema v1 · pii pii-v1

Full breach record for Vacation Myrtle Beach →

Vacation Myrtle Beach (VMB) and affiliates Legacy Business Solutions LLC and Enjoi Resort, Inc. notified the New Hampshire Attorney General of a data security incident. On June 16, 2025, VMB became aware of suspicious network activity. An investigation determined unauthorized access occurred, potentially exposing names, SSNs, driver's licenses, payment card info, financial account info, and medical/health insurance data. Seven New Hampshire residents were notified on May 15, 2026. VMB offered 12 months of credit monitoring and identity protection via TransUnion/Cyberscout. No evidence of misuse was found.

Leak gap clock✗ Leak >180d48 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed7 affectedView incident

A leak claim by play about this victim predates this filing by 334 days.View originating leak claim

Source provenance

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/vacation-myrtle-beach-20260515.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 15, 2026
Raw hash: ea9f4ea0e27d427086c14e61521e32174ee0d862ce14cd98b81d1a9a253df648

Reporting entity

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Victim entity

Name: Vacation Myrtle Beach
norm: vacation myrtle beach
Domain: vacationmyrtlebeach.com

Incident

Discovered: Jun 16, 2025
Materiality determined: —
Notification sent: May 15, 2026
Affected individuals: 7
Data types: IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICPHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General John M. Formella
Initial access: valid_credentials

Compliance

Time to disclose: 48 weeks(333 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Extraction provenance

Status: No extraction artifact recorded for this disclosure.