Fairmont Resort Data Breach Exposed Social Security Numbers

Fairmont Hot Springs Resort, a hot springs destination resort in Fairmont, Montana, experienced a data breach in August 2025 that exposed sensitive personal information for 828 Montana residents.

Fairmont Hot Springs Resort experienced a network disruption and launched an investigation into the incident. The company also engaged third-party specialists to assist with understanding the full nature and scope of what had occurred.

The investigation determined that certain information stored within the resort's systems was subject to unauthorized access or acquisition on or around Aug. 26, 2025.

Following the discovery, the company worked to identify and collect the data that was at risk. It then began a review to determine which types of information may have been affected and which individuals were involved. The review process was completed on Jan. 13, 2026.

The types of personal information that may have been exposed included first and last names, Social Security numbers, dates of birth, addresses, proof of current address, copies of government-issued identification cards, police reports, investigative reports and complaints to law enforcement agencies.

The breach was disclosed to the Montana Attorney General on March 10, 2026.

Fairmont Hot Springs Resort's response to the breach

The company is offering 12 months of complimentary single-bureau credit monitoring, credit report and credit score services through Cyberscout, a TransUnion company.

Affected individuals can enroll by visiting Cyberscout's activation page and entering the unique enrollment code provided in their notification letter. Enrollment must be completed within 90 days of the date of the letter.

The company is additionally providing proactive fraud assistance through Cyberscout to help affected individuals with any questions they may have or in the event that they become victims of fraud. A dedicated assistance line has been set up and is available Monday through Friday from 8 a.m. to 8 p.m. Eastern time, excluding holidays. The phone number for each affected individual is included in their notification letter.