Conquest Adventures, LLC recently disclosed a ransomware attack that resulted in unauthorized access to its systems and encryption of company data. In a notification filed with the Idaho Attorney General’s Office, the company reported that personal information belonging to hundreds of individuals, including Idaho residents, may have been exposed.
Companies that collect personal identification information from their customers have a responsibility to keep that information secure. When a ransomware attack breaches those defenses, affected individuals deserve to understand what happened and what steps they can take to protect themselves.
Conquest Adventures’s Data Breach Investigation
According to a notification sent to the Idaho Attorney General’s Office, Conquest Adventures became aware of a data incident and ransomware attack on June 12, 2026. The company reports that an unknown entity briefly accessed its systems and encrypted data. On July 14, 2026, Conquest Adventures determined that certain individuals’ personal data could have been accessed by the intruder during the incident. The company states that, to date, no evidence of misuse of the exposed information has been found. In total, 868 individuals have been identified as affected by the breach, including 11 residents of Idaho, and the company began notifying state regulators and affected individuals in late July 2026.
Ransomware attacks like the one described in this notice remain one of the most common causes of data breaches across nearly every industry, in part because a successful ransomware intrusion frequently gives attackers broad access to a company’s network before encryption even begins, creating an opportunity to copy or exfiltrate sensitive files before locking them. Even when a company reports no evidence of actual misuse of the compromised data, security researchers generally advise treating exposed identity documents such as driver’s license and passport numbers as a standing risk, since stolen data from these attacks can be held, sold, or used well after the initial incident is resolved.
Notification laws like Idaho’s generally require companies to report data breaches involving personal information within a reasonable timeframe, both to the state Attorney General’s Office and to affected residents. This kind of notification framework exists specifically because early awareness gives affected individuals a meaningful opportunity to protect themselves before any stolen information is misused. In this case, the roughly six-week gap between the initial ransomware attack and the company’s confirmation of affected personal data reflects the kind of forensic investigation many companies undertake to determine the true scope of an incident before notifying anyone.
The specific combination of information reported here, names paired with driver’s license numbers and passport numbers, is particularly attractive to identity thieves because government-issued identification numbers can be used to attempt to open new accounts, apply for loans, or even create fraudulent identification documents in a victim’s name. Passport numbers in particular can also be misused in immigration or travel-related fraud schemes, which makes them a distinct concern from a typical financial-data breach.
Anyone who has done business with Conquest Adventures and receives a notification letter, or who otherwise believes their information may have been part of this incident, should take the notice seriously even in the absence of confirmed misuse so far. Ransomware-related breaches are also frequently followed by opportunistic phishing campaigns that reference the incident to try to trick victims into handing over even more personal information, so recipients of any notice should be cautious about unsolicited follow-up contact referencing this breach.
When Did This Breach Occur?
Conquest Adventures reports that the ransomware attack and unauthorized access began on June 12, 2026. The company determined on July 14, 2026 that personal data belonging to certain individuals could have been accessed, and it notified the Idaho Attorney General’s Office of the incident on July 23, 2026.
What Information Was Breached?
According to the notification filed with the Idaho Attorney General’s Office, the compromised information includes names, addresses, driver’s license numbers, and passport numbers. A total of 868 individuals were affected, including 11 residents of Idaho.
What You Can Do
If you believe you may have been affected by the Conquest Adventures data breach, consider taking the following steps:
- Place a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion).
- Monitor your credit reports and financial accounts for any unfamiliar activity.
- Enroll in any identity theft protection services offered by Conquest Adventures, including through IDX.
- Consider contacting the U.S. Department of State if you are concerned about potential misuse of a compromised passport number.
- Be cautious of unsolicited calls, texts, or emails referencing this breach, which may be phishing attempts.
- File a report with the Federal Trade Commission at IdentityTheft.gov if you suspect your information has been misused.
File a Data Breach Lawsuit Against Conquest Adventures
If your personal information was exposed in the Conquest Adventures data breach, you may have legal options available to you. Companies that fail to adequately protect sensitive personal data from ransomware attacks can potentially be held accountable for the resulting harm.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
