Aman Resorts (aman.com) Listed by shinyhunters Ransomware Group

On April 18, 2026, the luxury hospitality group Aman Resorts appeared on the leak site of the shinyhunters ransomware group with more than 500,000 Salesforce records containing personally identifiable information. The attackers gave the company until 21 April 2026 to pay or face full public release of the data along with additional digital disruptions.

What Public Reporting Shows

Public reporting indicates that shinyhunters exfiltrated internal files during a ransomware incident targeting aman.com. The dataset includes more than 500,000 Salesforce records holding PII. The group posted a final warning on its leak site stating it would leak the material and cause further problems if payment is not received by the deadline. Available reporting describes the incident as a classic ransomware double-extortion attempt: encrypt or steal data, then demand payment to prevent disclosure.

Why This Matters for You and Your Family

If you have ever stayed at an Aman property, attended an event there, or used their booking systems, your personal details may now sit in a criminal dataset with a ticking clock on it. Names, contact information, dates of birth, passport details, and payment records are the kinds of information that criminals use to open accounts, file fraudulent tax returns, or impersonate you. For families this risk multiplies: one parent’s leaked email can lead to children’s school or activity registrations being exposed, creating a single point of failure for household privacy.

The Doxxing and Identity-Chain Implications

Stolen hospitality records rarely stay isolated. A single email or phone number from the Aman breach can be cross-referenced with gaming usernames, social-media handles, and family addresses. Attackers chain these links to build full identity profiles that enable doxxing, SIM-swapping, or targeted extortion. Credential leaks of this type frequently cascade into account takeovers on gaming platforms, where children’s accounts become entry points for further harassment or theft because the same password or recovery email was reused.

Shinyhunters’ Publicly Known Track Record

Public reporting attributes shinyhunters with emerging in 2020 and focusing on high-profile data theft rather than pure encryption. The group has previously claimed responsibility for breaches at several large online services and has a pattern of stealing databases then offering them for sale or leaking them in stages to pressure victims. Their typical playbook involves initial access through compromised credentials or third-party suppliers, exfiltration of customer and internal records, followed by extortion demands that combine monetary payment with threats of reputational damage and “annoying digital problems.”

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what the Aman data connects to.
• Rotate the password you used on aman.com anywhere else it is reused and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same contact details.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your own accounts.

The Aman breach is a reminder that luxury brands you trust can still become gateways to identity theft for ordinary guests and their families. Acting quickly on the exposed data and establishing ongoing visibility is the most practical defense. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts—capabilities that directly address the cascade risks created by incidents like this one.