Brooklands of Mornington Listed by spacebears Ransomware Group

On April 6, 2026, Australian accommodation provider Brooklands of Mornington appeared on the leak site of the spacebears ransomware group. The listing indicates that internal files containing personal information of employees and guests, financial documents, and other company records were exfiltrated during a ransomware attack on the Mornington Peninsula resort.

What's Publicly Reported from Reporting

Public reporting on the spacebears leak site describes the data as including guest and staff personal details along with financial records. The exact number of individuals affected remains unknown, and the precise date of the initial breach has not been publicly confirmed. The company, which operates a historic property built circa 1878, offers resort-style accommodation and has not yet issued a detailed public statement on the volume or specific fields exposed.

Available reporting indicates the files were stolen and are now hosted on the group’s onion site, a common tactic used to pressure victims into payment. No evidence has surfaced that the data has been sold to third parties, but its presence on a ransomware leak site means it is effectively public.

Why This Matters for You and Your Family

If you or any member of your family stayed at Brooklands of Mornington, booked an event there, or worked at the property, your personal information may now be in the hands of cybercriminals. Guest details and employee records frequently include full names, addresses, phone numbers, email addresses, and dates of birth. Financial documents can contain payment card information or bank details that remain valuable long after the breach.

Once this type of data leaves a company’s control, it rarely stays contained. It can appear on dark-web markets, get bundled into larger datasets, or be used to launch targeted attacks against you months or even years later. For families, a single exposed booking can link parents and children through shared addresses and contact information.

The Doxxing and Identity-Chain Implications

Ransomware leaks like this one often serve as the starting point for doxxing chains. Criminals combine the newly exposed guest or employee data with information already circulating from previous breaches. A phone number listed in the Brooklands files can be matched to gaming accounts, social-media handles, or school records, rapidly building a complete profile.

Credential leaks cascade into account takeovers, especially when the same password has been reused across services. Children’s gaming accounts are particularly vulnerable because they are often secured with family email addresses or phone numbers that appear in hospitality records. Once an attacker controls one account, they can pivot to others, harvest more data, and escalate to extortion or identity theft.

Spacebears Ransomware Group Track Record

Public reporting attributes the spacebears group with emerging in late 2024. The gang has targeted mid-sized organisations across hospitality, healthcare, and professional services. Notable prior victims include several Australian and European companies whose data appeared on the same leak site after ransom demands went unpaid.

The group’s typical playbook involves gaining initial access through phishing or exploited remote desktop services, exfiltrating sensitive files before deploying ransomware, and then publishing samples on their onion site if the victim refuses to pay. Their extortion style combines public shaming with the threat of full data release, a pattern consistent with many mid-tier ransomware operations active in 2025 and 2026.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have been exposed in the Brooklands files.
• Rotate any password you used when booking or working with Brooklands of Mornington and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak exposing you or your family is detected within hours rather than months.
• Cover the entire household with DoxxScan family protection, which includes children’s gaming accounts that often chain back to the same addresses and contact details found in hospitality records.
• Let remediation specialists handle takedown requests for any data-broker listings or exposed files that surface from this incident.

The Brooklands of Mornington breach is a reminder that your personal information can be taken from places you rarely think about twice. Acting quickly on the credentials and details already exposed can limit the damage before criminals stitch together a full identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that explicitly protects gaming accounts belonging to you or your children.