Kalahari Resorts Data Breach Exposes Social Security Numbers of Employees

Kalahari Resorts & Conventions, a hospitality company that operates large indoor waterpark resorts across the United States, disclosed a data breach in October 2026 that affected current and former employees of the company.

The incident was disclosed to the attorneys general offices of California and Texas, with 13,319 Texas residents identified as affected. Kalahari began notifying affected individuals by written notice on Oct. 30, 2026.

On Oct. 9, 2026, unauthorized access to the company's network was first detected. A subsequent investigation revealed that personal information was affected as a result of the incident.

The ransomware group known as INC Ransom claimed responsibility for the attack on its dark web site hosted on the Tor network. The group claims to have obtained organizational data from Kalahari.

The investigation determined that the types of personal information potentially exposed included names, addresses, dates of birth and Social Security numbers.

Kalahari Resorts & Conventions' response to the breach

The company is offering affected individuals 12 months of free single-bureau credit monitoring, credit report and credit score services. These services are being provided by Cyberscout, a TransUnion company.

To enroll, affected individuals can visit the Cyberscout activation page and enter the unique code provided in their notification letter. Enrollment must be completed within 90 days of the date of the letter.

Kalahari has set up a dedicated help line at 1-855-711-7980, available Monday through Friday from 8 a.m. to 8 p.m. Eastern time, excluding holidays. Representatives are available for 90 days from the date of the notification letter to assist with questions about the incident.