Fun For Less Tours, Inc., a travel agency based in Draper, Utah, has begun notifying individuals that a ransomware attack led to the unauthorized access and acquisition of files stored on the company’s network. Businesses that collect and retain personal information from customers, including for travel bookings and passenger records, have a responsibility to protect that data from exactly this kind of intrusion.
Fun For Less Tours’s Data Breach Investigation
According to a notification letter filed with the California Attorney General’s office, Fun For Less Tours discovered on October 27, 2025 that it had been the victim of a ransomware attack. Upon learning of the incident, the company states that it promptly began an investigation, worked to secure its systems, and notified law enforcement. The company’s investigation determined that an unknown, unauthorized third party had accessed its computer network and acquired certain files during the incident.
Fun For Less Tours reports that it conducted a comprehensive review of the acquired files to determine whether they contained personal information, and on March 23, 2026, the company determined that the files did contain personal information belonging to some of the individuals it notified. The notification letter filed with regulators uses a template format that does not spell out, in the copy made public, a single universal list of exactly which data elements were involved for every affected person. Fun For Less Tours has not otherwise published a company-wide breakdown of the specific data categories exposed.
Ransomware attacks like the one described by Fun For Less Tours have become one of the most common causes of data breach notifications nationwide. In a typical ransomware incident, attackers infiltrate a company’s network, often through a phishing email, a compromised remote access credential, or an unpatched software vulnerability, and then either encrypt files to disrupt operations, exfiltrate files to use as leverage in an extortion attempt, or both. Because travel and tour companies routinely collect passport information, travel itineraries, payment details, and other sensitive customer records to book flights, hotels, and excursions, they can be an attractive target for cybercriminals looking to harvest data that can be resold or used to commit fraud.
The gap between when a breach is discovered and when a company can confirm exactly whose data, and what data, was involved is also common in these incidents. Forensic investigations into ransomware attacks can take weeks or months to complete, since investigators must sort through potentially large volumes of acquired files to determine what personal information they contain and to whom it belongs before individual notifications can be issued. Fun For Less Tours’s own timeline, an October 2025 discovery followed by a March 2026 determination of which files contained personal information, reflects that kind of extended review process.
State and federal data breach notification laws generally require companies to notify affected individuals and regulators within a set window once the scope of a breach involving personal information has been determined, though the exact deadline varies by state. Filing a notice with a state Attorney General, as Fun For Less Tours did in California, is a standard part of that regulatory compliance process rather than an indication of anything unusual about the incident. What matters most to affected individuals is not the administrative timeline but the practical question of whether their own information was exposed and what steps they can take to protect themselves going forward.
Whatever specific data elements were exposed in this incident, individuals whose personal information is compromised in a data breach can face a heightened risk of identity theft, phishing attempts, and other forms of fraud for months or years afterward, since stolen personal data is frequently bundled and sold on dark web marketplaces long after the original breach occurred. Attorneys who investigate data breach cases look closely at how quickly a company detected an intrusion, how it secured its systems afterward, and whether it took reasonable steps to safeguard the personal information entrusted to it in the first place.
When Did This Breach Occur?
Fun For Less Tours states that it discovered the ransomware attack on October 27, 2025. The company’s investigation into which files were affected and whether they contained personal information concluded on March 23, 2026, at which point notifications began going out to affected individuals.
What Information Was Breached?
Fun For Less Tours’s notification letter confirms that files acquired by the unauthorized party contained personal information belonging to affected individuals, but the version of the letter made public does not specify a single universal list of which data elements were involved for every person notified. Fun For Less Tours has not otherwise published a company-wide breakdown of the specific categories of information exposed.
What You Can Do
Fun For Less Tours has arranged for affected individuals to enroll in a complimentary one-year membership of Experian IdentityWorks credit monitoring, which can help detect potential misuse of personal information. If you received a notification letter from Fun For Less Tours, consider taking the following steps:
- Enroll in the complimentary credit monitoring offered in your notification letter before any stated deadline
- Review your financial account statements and credit reports regularly for unfamiliar activity
- Consider placing a fraud alert or credit freeze with the three major credit bureaus
- Report any suspicious account activity to your financial institution and to law enforcement promptly
File a Data Breach Lawsuit Against Fun For Less Tours
If you received a notice that your personal information may have been compromised in the Fun For Less Tours data breach, you may have legal options available to you. Companies that collect sensitive personal information have an obligation to implement reasonable safeguards to protect it, and a lawsuit can help hold a company accountable when that information is exposed.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
