Magna Hospitality Group has told regulators that an unauthorized actor copied files from its network.
Here is what the company has disclosed so far and what you can do if you received a notice.
Magna Hospitality Group’s Data Breach Investigation
Magna Hospitality Group, based in Warwick, Rhode Island, describes itself as a hotel investment, development and management firm. It has filed a notice of a data event with the California Attorney General, and the filing appears in that office’s public breach listing with a posting date of October 13, 2026.
According to the template notice letter filed with the state, the company became aware of suspicious activity affecting certain systems on its network on May 24, 2025, and began an investigation. The company says that investigation found an unauthorized actor gained access to certain systems between May 22, 2025 and May 24, 2025, and copied certain files during that time. It then launched a review of the files involved to identify what they contained and to whom the information relates.
The company also says it has added cybersecurity measures to guard against similar incidents and has notified federal law enforcement. It is offering affected people credit monitoring and identity theft protection through Experian at no cost. The filed letter leaves the length of the service and the enrollment deadline as blank merge fields, so those details are not stated here. The letter says people must enroll on their own, because the company cannot enroll them. A toll-free response line is listed for questions, and the letter also gives a mailing address in Warwick for written inquiries.
The timeline is the most notable part of the public record. The unauthorized access took place in May 2025, and the notice was filed with the California Attorney General in October 2026, more than seventeen months later. The letter explains that the company had to review the copied files to learn what they held and who was involved. File reviews of this kind can take a long time, especially when the files are unstructured documents and not a tidy database. Even so, people whose information was in those files may have gone a long stretch without knowing.
The filed copy of the letter is a mail-merge template, not a completed notice. The sentence identifying the types of information involved is an unfilled placeholder, and the sentence describing when the file review finished is a blank option as well. For that reason, this page does not say which kinds of information were involved, and it does not guess. The company has also not published a count of the people affected in the material reviewed for this page.
The letter does say that the copied files held each recipient’s name together with other information specific to that person. A name paired with additional personal data can be enough for a criminal to attempt identity theft or to craft a convincing phishing message. The exact risk depends on which data elements applied to you, which only your individual letter can tell you. Until you know, treat unexpected messages that mention the company, your employment, or a stay at one of its properties with extra suspicion, and avoid clicking links or sharing details in response.
Hospitality companies handle a wide range of personal records, from employee and payroll files to vendor and guest information. Which of those groups were affected here is not disclosed in the public record. If you worked for, stayed at, or did business with a property tied to the company, your own notice is the best guide.
Because the filed letter does not state the length of the monitoring service or the enrollment deadline, anyone who receives a notice should look for those details in their own copy and enroll before the deadline passes, since monitoring services generally require the recipient to activate them. If you received a letter from this company, keep it and the envelope, note the date you received it, and read it closely for the specific data types and the enrollment deadline for the monitoring service. The public template does not carry that detail.
When Did This Breach Occur?
The company says it became aware of suspicious activity on May 24, 2025, and that an unauthorized actor accessed certain systems between May 22, 2025 and May 24, 2025, copying files during that time.
The company’s notice appears in the California Attorney General’s breach listing with a posting date of October 13, 2026. The filed letter does not give a date for when the file review finished.
What Information Was Breached?
The filed notice does not identify the data types. The sentence that would list them is an unfilled placeholder in the public copy, so no specific categories are confirmed. The letter states that the files contained each recipient’s name along with other information specific to that person.
Your own letter should list the data elements that apply to you. Keep it for your records.
What You Can Do
If you received a notice related to Magna Hospitality Group or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the free Experian credit monitoring and identity theft protection that the letter describes, since the company says it cannot enroll you itself. Check your notice for the enrollment deadline.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Magna Hospitality Group
If your personal information was exposed in this incident, you may have legal options. Companies are expected to protect the information they collect, and a class action can help hold them accountable when security falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
