Almeida Law Group is investigating a data breach at Waterford Hotel Group, LCC & LMD Holding Company, LLC. If you were affected, contact Almeida Law Group.
About Waterford Hotel Group, LCC & LMD Holding Company, LLC
Waterford Hotel Group is a national hospitality management company founded in 1986 and headquartered in Waterford, Connecticut. It develops, owns, and operates hotels ranging from boutique inns to large convention properties, with a portfolio that includes branded Marriott and Hilton hotels as well as independent properties across the United States. In late 2025, Waterford merged with Maverick Hotels & Restaurants, expanding its combined portfolio to more than 50 properties. LMD Holding Company, LLC is the corporate parent of Waterford Hotel Group, LLC, as confirmed in federal court filings. The breadth of data categories reported in this breach — including Social Security numbers, government ID numbers, financial account information, and health records — suggests the compromised data likely includes employee records.
What Happened?
Waterford Hotel Group, LCC & LMD Holding Company, LLC was listed in a Vermont Attorney General breach report summary dated September 25th, 2026. The filing confirms that the following categories of personal information were compromised: Social Security numbers, government ID numbers, financial account codes, credit and debit account information, and health records.
Supplemental threat intelligence reporting adds important context. On May 11th, 2026, the Interlock ransomware group claimed responsibility for an attack on Waterford Hotel Group on its dark web leak site. This claim was tracked by Ransomware.live and reported by threat intelligence aggregators including DeXpose and RedPacket Security. According to those attacker-side posts, the incident involved data exfiltration — including personal, confidential, and financial information — rather than encryption alone. These remain attacker allegations; Waterford Hotel Group has not issued a public statement independently confirming ransomware as the attack vector or otherwise addressing the incident. The roughly four-and-a-half-month gap between the May 11th, 2026 leak-site claim and the September 25th, 2026 Vermont AG filing may reflect a delay in consumer notification. No class action litigation connected to this breach has been identified as of September 25th, 2026.
Key Facts at a Glance
- Company or Organization: Waterford Hotel Group, LCC & LMD Holding Company, LLC
- Industry: Hospitality — hotel development, ownership, and management
- Location: Waterford, Connecticut
- Incident type: Data breach (ransomware attack alleged by Interlock group; not independently confirmed by the company)
- Date breach discovered: September 25th, 2026
- Date of consumer notification: September 25th, 2026
- Data types exposed: Social Security numbers, government ID numbers, financial account codes, credit and debit account information, health records
- Litigation status: No class action litigation related to this breach found as of September 25th, 2026
- Source: Vermont Attorney General breach report summary; DeXpose — Interlock Ransomware Targets Waterford Hotel Group; RedPacket Security — Ransomware Victim: Waterford Hotel Group; Hotel Management — Waterford Hotel Group, Maverick Hotels merge; CourtListener — Paquin v. Waterford Hotel Group, LLC
What Should You Do?
If you received a notice from Waterford Hotel Group or LMD Holding Company, take steps now to protect yourself. Because Social Security numbers, government IDs, financial account information, and health records were all confirmed as compromised, the risk of identity theft and financial fraud is significant. Place a fraud alert or credit freeze with each of the three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your credit reports regularly through AnnualCreditReport.com. Review your bank and credit card statements for any unauthorized transactions and report suspicious activity to your financial institution immediately. If identity theft does occur, report it at IdentityTheft.gov for a personalized recovery plan. Because health records were also involved, review any Explanation of Benefits statements from your insurer and check your medical records for services you did not receive. If identity theft protection enrollment is offered as part of the breach notification you received, enroll before any stated deadline.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
