Lessing’s Hospitality Group, a family-owned hospitality company operating over 120 locations across the Northeast and Florida, experienced a data breach after detecting suspicious activity in an employee’s email account on August 20, 2025. Unauthorized access exposed emails containing sensitive personally identifiable information (PII) of customers, including names, addresses, dates of birth, Social Security numbers, driver’s license/state ID details, health insurance data, and financial account information. The breach impacted thousands of current/former employees and other individuals, with notifications issued on October 3, 2025. The incident was also reported to the Vermont Attorney General’s office on October 6, 2025. Affected parties face risks of identity theft, financial fraud, and unauthorized account access, prompting legal investigations for potential compensation claims. The breach stems from a phishing-related compromise of an employee’s email, leading to exposure of highly sensitive customer and employee data.

Lessing’s Hospitality Group, a New York and Florida-based hospitality company, suffered a data breach after detecting unauthorized access to an employee email account. The investigation confirmed that sensitive personal information (PII/PHI) of current and former employees—including names, addresses, Social Security numbers, driver’s license copies, health insurance details, and financial account information—may have been viewed. The breach was disclosed to affected individuals via mail (October 3, 2025) and reported to the Vermont Attorney General’s office (October 6, 2025). While the exact number of impacted individuals remains undisclosed, the breach potentially affects thousands. The company secured its email environment and engaged a forensic firm to investigate, but the exposure of highly sensitive employee data poses significant risks of identity theft, financial fraud, and phishing attacks.