Waterford Hotel Group / LMD Holding data breach (2026): what was exposed and what to do

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

Waterford Hotel Group and LMD Holding say they discovered unusual activity on their network on May 5, 2026. Their investigation found that an unauthorized actor gained access to systems and could view or download certain data. The organizations reviewed the information and are notifying affected individuals.

What the notices say

The company notice lists potential categories including names, Social Security numbers, driver’s license, passport and tax identifiers, financial account and payment-card information, account credentials, and medical or health-insurance information. The categories vary by individual. Receiving a notice does not mean all of these fields applied to you.

Vermont’s register lists 242 affected Vermont residents in a September 25, 2026 report. This is a state figure, not a confirmed nationwide total. The notice does not establish that every hotel guest was affected.

The company’s incident assistance line is 888-940-9724. Use the official notice to confirm enrollment instructions and any deadline.

What to do now

1. Keep your notice. It identifies the data categories that applied to you and any enrollment deadline.
2. Verify the notice through the organization’s official website or a contact number you already trust. Do not use an unexpected message’s links or share passwords or one-time codes.
3. If Social Security or other identity information was involved, consider a free credit freeze with each of the three major U.S. bureaus. A freeze helps restrict new credit; it does not stop transactions on existing accounts.
4. Review bank and card statements. Contact the institution about unfamiliar transactions. If health information was involved, also check insurance statements for unfamiliar claims.
5. Use IdentityTheft.gov if someone is using your identity. Enroll in any monitoring offer through the verified notice’s instructions.

For help interpreting a letter, see a company emailed me about a breach.

If your notice names a username or password, change that password and any reused copies on other services. Enable multi-factor authentication where available.

What a Delist scan can tell you

A free Delist scan checks personal-data exposure on the sources we cover. It does not inspect this organization’s systems, establish whether your record was involved in this incident, or erase breach dumps. Paid listing-removal work requires separate authorization.

This summary is compiled from public notices and reporting available when this page was last updated. Figures may change as investigations continue. Confirm your own exposure and any assistance offer with the organization named in your notice.

Inclusion is a record of a publicly reported incident, not an allegation of wrongdoing or negligence.

Is 242 the total affected population?

No. Vermont lists 242 affected residents in its September 25, 2026 report. This is a state count, and the company notice does not establish a nationwide total or that every hotel guest was affected.

Frequently asked questions

Did every affected person have all the listed fields exposed?

No. The company says the information varies by individual. Read your notice for the fields that applied to you.

What if my notice names an account password?

Change that password and any reused copies on other services, and enable multi-factor authentication where available. Verify the notice and assistance instructions through the official company notice.