On April 30, 2026, travel company Morning Star Tours appeared on the leak site of the pear ransomware group, with attackers claiming to have exfiltrated internal files during a ransomware incident. The posting affects anyone whose personal information was stored in the company’s systems, including customers who booked tours, employees, and their family members whose details may have been included in reservation or employment records.
Watch Morning Star Tours
Get alerted the next time Morning Star Tours files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Morning Star Tours’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Available reporting describes the incident as a ransomware attack in which the pear group obtained and later published samples of internal files. The leak site lists Morning Star Tours under its April 30, 2026 entry. Public reporting indicates the company provides travel and tour services, and the exposed material consists of internal files exfiltrated rather than a simple credential dump. No confirmed total number of affected individuals has been released, leaving many customers uncertain whether their data is among the stolen records.
Why This Matters for You and Your Family
When a company that holds names, addresses, phone numbers, payment details, or passport information suffers a breach, that data does not remain contained. It can surface on dark-web markets within weeks, giving identity thieves, scammers, and harassers easy starting points. For families, a single parent’s booking record can expose children’s names and dates of birth. Employees’ personnel files can reveal Social Security numbers or direct-deposit information that put household finances at risk. The absence of a published victim count does not mean your information is safe; it simply means you must assume exposure until proven otherwise.
The Doxxing and Identity-Chain Implications
Ransomware leaks rarely stop at one dataset. A single email or phone number from the Morning Star Tours files can be combined with information from previous breaches to build a complete profile. Attackers link gaming usernames, social-media handles, and family addresses into chains that lead to doxxing, account takeovers, or targeted extortion. Credential leaks like this one cascade into gaming account compromises because children often reuse simplified passwords across tour sign-ups, school portals, and Roblox or Fortnite accounts. Once an attacker controls a child’s gaming profile tied to the family address, further personal details become trivial to obtain.