Aman Resorts Data Breach: 261,232 Guest Records Exposed

In April 2026, HEROIC analysts identified a verified data breach tied to Aman Resorts, the ultra-luxury hospitality brand, exposing 261,232 records. The exposed fields included email addresses, first and last names, phone numbers, birthdays, and genders. Guests who have booked with the brand should not assume their information stayed private; scan your email to find out whether your address appears in this exposure.

Why This Is Dangerous

Personal details like a birthday paired with a full name and phone number give scammers exactly what they need to sound convincing. A caller who already knows your date of birth and recites your name correctly feels legitimate, which is precisely what makes follow-on fraud effective. Combined with an email address, this record set becomes raw material for phishing that references real personal facts.

What Was Exposed

• Email Address
• First Name
• Last Name
• Phone Number
• Birthday
• Gender

In practical terms, this kind of record set fuels impersonation attempts, fake booking confirmations, and phone based social engineering aimed at travelers. Someone holding this data could pose as hotel staff or a loyalty program representative and use the birthday and phone number to build trust before asking for payment details or account access.

According to HEROIC analysts, this exposure fits the pattern of a database breach, meaning the records were taken directly from the company's own internal systems rather than pulled from an individual's infected device. That distinction matters because the data was structured and complete at the point of theft, rather than scattered across many separate compromises.

Check Whether Your Email Was Exposed

The fastest way to know your exposure is to scan your email against HEROIC's breach records. If your address appears, watch for calls or messages that reference your name, birthday, or phone number, since those details can make a scam feel personal and trustworthy. Update the contact details tied to any hospitality or loyalty accounts you hold.

This applies equally to personal and work email addresses, since either one may have been used when booking travel.