Ocean Edge Resort data breach: files copied in July 2025, letters in August 2026

Date	Event
July 22, 2025	First day of the unauthorized access the investigation found
July 31, 2025	Ocean Edge becomes aware of suspicious activity; access ends
August 24, 2026	Date on the letter filed in Massachusetts
August 25, 2026	Reports to Massachusetts (2,791) and New Hampshire (10); letters mailed

What happened at Ocean Edge Resort?

Ocean Edge's counsel told New Hampshire that the resort became aware of suspicious activity in its network on July 31, 2025 and opened an investigation right away. The investigation found the intruder had been in the network for about nine days, from July 22, and had copied files. The resort then reviewed those files to see what they contained and whose information was in them. It also notified federal law enforcement.

Neither the notice nor the letter names the intruder, says how it got in, or says whether a ransom was demanded. The letter sent to Massachusetts residents does not describe what happened, so the New Hampshire notice is the only filed account of the intrusion found for this entry.

What information was exposed?

The New Hampshire notice lists name, Social Security number, driver's license number and financial account information. Massachusetts marks the same three categories: Social Security numbers, financial accounts and driver's licenses, with no medical records and no card numbers. Neither filing says whether the records belong to employees, members or guests.

Record	Residents	Data it marks
Massachusetts OCABR, report 2026-1430	2,791	Social Security numbers, financial accounts, driver's licenses
New Hampshire DOJ notice, August 25, 2026	10	Name, Social Security number, driver's license, financial account
Two states	2,801

Why did Ocean Edge take 13 months to send letters?

The notice gives one reason: after the investigation, Ocean Edge carried out a detailed review of the copied files to find out what information they held and to whom it belonged. It does not say when that review ended. From discovery on July 31, 2025 to the August 25, 2026 notices is 390 days. The notice delay guide compares that gap with other notices.

What is Ocean Edge offering?

The letter to Massachusetts residents offers 24 months of credit monitoring through TransUnion at no cost, with enrollment at bfs.cyberscout.com/activate using the code in the letter. Enrollment must happen within 90 days of the letter's date. The New Hampshire notice describes twelve months of TransUnion monitoring. The term depends on the state the letter went to. With a letter dated August 24, the 90 days run out in late November 2026. Anyone who has the letter and has not enrolled should do it now. A credit freeze is the stronger step when a Social Security number is involved. The credit monitoring guide explains the difference.

The Massachusetts hospitality reports this year

Another hotel operator reported to Massachusetts a month later. The Waterford Hotel Group entry covers a Connecticut hotel company's breach (MA 2,612, September 25, 2026). The Massachusetts 2026 ranking lists the state's largest reports.

What the documents leave open

• Whose records the copied files held: employees, members, guests or a mix.
• How the intruder got into the network.
• When the file review ended, and the total number notified in all states.