Almeida Law Group is investigating a data breach at Hotel Online. If you were affected, contact Almeida Law Group.
About Hotel Online
The notice was published on behalf of Waterford Hotel Group, LLC and its corporate parent LMD Holding Company, LLC, a national hospitality management company headquartered in Waterford, Connecticut. With nearly 40 years of experience, Waterford manages a portfolio of more than 50 properties — ranging from boutique New England inns to large full-service hotels and convention centers — and employs between 1,000 and 5,000 people. Because the company collects reservation, payment, and employment data across its properties, it holds a broad range of sensitive personal and financial information for guests and staff alike.
What Happened?
Waterford Hotel Group was listed in a notice published on the organization’s website on September 30th, 2026. On May 5th, 2026, Waterford identified suspicious activity on certain computer systems, immediately took steps to secure those systems, and engaged third-party forensic specialists to investigate. Through that investigation, the company determined that an unknown actor gained access to certain systems and was able to view or download data. Waterford completed its review of who was affected and began notifying individuals approximately 147 days after discovery. The types of personal information stored on the impacted systems vary by individual but may include: name, driver’s license number, Social Security number, passport number, taxpayer ID, financial account information, payment card information, username and password, medical information, and health insurance information.
The Interlock ransomware group claimed responsibility for an attack on Waterford Hotel Group on its dark web leak site on May 11th, 2026 — six days after Waterford’s stated discovery date. This is an attacker-side allegation only; Waterford’s official notice does not reference ransomware or name any threat actor, referring only to “an unknown actor.” Third-party threat intelligence sources, including DeXpose and RedPacket Security, reported that the Interlock leak-site post described data exfiltration rather than encryption. No class action lawsuit has been filed yet, but multiple law firms — including Shamis & Gentile P.A. and Federman & Sherwood — are actively investigating potential class action claims on behalf of affected individuals.
Key Facts at a Glance
- Company or Organization: Waterford Hotel Group, LLC & LMD Holding Company, LLC
- Industry: Hospitality / Hotel Management
- Location: Waterford, Connecticut, United States
- Incident type: Unauthorized access — unknown actor viewed or downloaded data from company systems
- Date breach discovered: May 5th, 2026
- Date of consumer notification: September 30th, 2026
- Prior breach: No prior breaches found in available sources
- Litigation status: No class action filed; Shamis & Gentile P.A. and Federman & Sherwood are investigating for potential class action claims
- Source: Hotel Online notice; PR Newswire official notice; Federman & Sherwood investigation; DeXpose threat intelligence report; RedPacket Security report
What Should You Do?
If you received a notice from Waterford Hotel Group, call the dedicated helpline at 1-888-940-9724 (Monday through Friday, 8:00 a.m. to 8:00 p.m. Eastern Time, excluding major U.S. holidays) for guidance specific to your situation. Because the exposed data may include Social Security numbers, financial account information, and payment card numbers, you should consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion. Review your credit reports for free at AnnualCreditReport.com and monitor your bank and credit card statements closely for unauthorized activity. If you believe you are a victim of identity theft, report it and get a personal recovery plan at IdentityTheft.gov. Because medical information and health insurance information were also listed among the potentially exposed data types, you should review your Explanation of Benefits statements and contact your health insurer if you notice any services you did not receive.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
