Vacation Myrtle Beach Suffers Ransomware Attack, Exposing Sensitive Data of Over 10,000 Individuals Vacation Myrtle Beach, a major oceanfront resort group in South Carolina, disclosed a data breach affecting 10,750 individuals across the U.S., including four Maine and six Vermont residents. The company sent notification letters on May 15, 2026, detailing the incident. The breach was first detected on June 16, 2025, when the company identified suspicious activity in its network. After securing its systems, Vacation Myrtle Beach launched an investigation with independent forensic experts. Three days later, the PLAY ransomware group claimed responsibility, posting on the dark web that it had exfiltrated sensitive data including client documents, payroll records, tax information, and financial data and threatened to publish it on June 23, 2025. The investigation confirmed unauthorized access to personally identifiable information (PII), such as names, Social Security numbers, driver’s license details, financial account data, and passport numbers. Additionally, protected health information (PHI) may have been exposed. In response, Vacation Myrtle Beach offered affected individuals complimentary credit monitoring and identity protection services through Cyberscout (a TransUnion company), with a 90-day enrollment window from the notification date. A dedicated helpline (1-877-424-7790) was also established for inquiries.