Fairmont Hot Springs Resort, a resort and hot springs destination located in Fairmont, Montana, has notified the Montana Department of Justice’s Office of Consumer Protection of a data security incident that may have exposed the personal information of hundreds of guests. The resort reported that 828 Montana residents were affected.
Businesses that collect and store guest information, including names and other personal details used for reservations and billing, are expected to take reasonable steps to keep that information secure. When a hospitality business experiences a network intrusion, guests are left to wonder what information may have been exposed and what, if anything, the business is doing to help protect them.
Fairmont Hot Springs Resort’s Data Breach Investigation
According to a notification letter filed with the Montana Department of Justice, Fairmont Hot Springs Resort experienced a network disruption and promptly opened an investigation, engaging third-party specialists to determine the nature and scope of the incident. That investigation determined that certain information within the resort’s systems was subject to unauthorized access or acquisition on or around August 26, 2025. The resort stated that its review process, which included identifying the data at risk and confirming current mailing addresses for notification, was completed on January 13, 2026, roughly five months after the unauthorized access is believed to have occurred.
The resort’s notification letter identifies the types of information involved only in general terms, referencing a guest’s first and last name in combination with additional data elements that the filed copy of the letter does not spell out. This is a common feature of sample notification letters filed with a state regulator, which are often the template used for an eventual mail merge rather than a filled-in copy sent to any specific individual. Fairmont Hot Springs Resort reported that 828 Montana residents were affected by the incident, though the total number of individuals affected nationwide, if different, has not been separately disclosed.
Hospitality and resort businesses can be attractive targets for cybercriminals because they routinely process a steady stream of guest reservations, payment information, and identifying details across networked booking and property-management systems. A single point of compromise in one of these systems can potentially expose data belonging to guests who stayed at the property over an extended period, not just those who visited around the time the intrusion is believed to have occurred. The five-month gap between the reported August 2025 unauthorized access and the January 2026 completion of the resort’s review is not unusual for this type of incident: forensic investigators typically need to reconstruct what was accessed, determine which individuals’ records were involved, and confirm current addresses before a notification can be issued, a process that commonly takes months rather than days.
Fairmont Hot Springs Resort stated that it has taken steps to secure its systems and has implemented additional technical safeguards intended to prevent similar incidents in the future. The resort is also offering affected individuals single-bureau credit monitoring and credit report services at no charge for twelve months through Cyberscout, a TransUnion company, along with proactive fraud assistance.
Guests who received a notification letter, or who stayed at Fairmont Hot Springs Resort and are concerned they may have been affected, should review the letter carefully once received and enroll in any complimentary monitoring services offered, since the letter indicates enrollment must generally be completed within a limited window from the date of the notice.
Montana’s data breach notification law requires businesses that experience a security incident affecting Montana residents’ personal information to notify both the affected individuals and the state’s Office of Consumer Protection, which is why this incident is publicly documented through a state filing rather than only a private letter to guests. That regulatory requirement gives consumers an independent way to confirm that a reported breach actually occurred and to track how businesses in the state have responded, even when a company’s own public statements about an incident are limited.
When Did This Breach Occur?
Fairmont Hot Springs Resort’s notification letter states that unauthorized access to or acquisition of certain information within its systems occurred on or around August 26, 2025. The resort’s investigation and review process was completed on January 13, 2026, at which point it determined that certain personal information may have been affected and began confirming current addresses to send notifications.
What Information Was Breached?
Fairmont Hot Springs Resort’s filed notification letter states that the affected information may have included a guest’s first and last name in combination with certain other personal data elements specific to that individual. The filed copy of the letter does not spell out the complete, universal list of data types involved for every affected person, and the resort has not separately published a full breakdown beyond what appears in the notification letter itself.
What You Can Do
Fairmont Hot Springs Resort is offering affected individuals single-bureau credit monitoring and credit report services at no charge for twelve months through Cyberscout, a TransUnion company, along with proactive fraud assistance. Guests can also take these additional steps:
- Enroll in the complimentary credit monitoring service referenced in your notification letter within the enrollment window it specifies.
- Review your credit reports and account statements regularly for unfamiliar activity.
- Consider placing a fraud alert or credit freeze with Equifax, Experian, and TransUnion.
- Contact the resort’s dedicated assistance line referenced in your letter with any questions.
- Report any suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Fairmont Hot Springs Resort
If your personal information was compromised as a result of the Fairmont Hot Springs Resort data breach, you may have legal options. Businesses that collect and store guest information have a responsibility to protect it with reasonable security measures, and individuals harmed by a failure to do so may be able to pursue compensation through a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
