Pyramid Global Hospitality data breach: 139,899 current and former employees notified in February 2026

What happened in the Pyramid Global Hospitality breach?

The letter tells the story in two steps. First, after it saw suspicious activity in August 2025, Pyramid's investigation with outside forensic specialists found no sign that any of its data had been affected. Then, on September 30, 2025, it found that data on its servers had been. A review of the affected data followed, and the company says it sent the notice after determining that current and former employee data was likely involved.

The letter does not say how the attacker got in, whether it was ransomware, or whether anyone claimed the attack. It says Pyramid reported the event to federal law enforcement and is notifying state regulators.

Date	What happened	Source
August 13, 2025	Breach date in California's record	California list
On or about August 14, 2025	Pyramid becomes aware of suspicious activity on its network	Letter
September 30, 2025	Pyramid finds that data on its servers was affected	Letter
October 2025	Current employees may already have been told of the event	Letter
February 25, 2026	Letters sent; notice recorded by California, Vermont and Indiana	Letter; state records
May 25, 2026	Deadline to enroll in the monitoring offer	Letter

From the first sign of trouble to the letters took 195 days, and 148 days from the day the company found its data had been affected. The notice-delay guide shows how that compares with other notices.

Who was affected by the Pyramid Global Hospitality data breach?

Current and former employees. The letter says so directly, and it tells current employees they may already have had a notice of the same event in October 2025. Nothing in the letter says hotel guests' data was involved.

What information was exposed?

The letter lists name, Social Security number, driver's license or state identification number, other governmental identification numbers, financial account information, health insurance information and medical information. It adds that the company cannot confirm all of those types were affected for each person; the letter each person received is the record for their own data.

How many people were affected?

139,899 in total, per Indiana's 2026 report, with 1,824 of them in Indiana. California's record and the Vermont filing do not give a count. The Indiana row gives August 14, 2025 as the breach date; California's list gives August 13, 2025.

Texas's attorney general lists a report from Pyramid Advisors Limited Partnership d/b/a Pyramid Global Hospitality, posted on February 27, 2026, with 15,255 Texans affected. The Texas record lists names, Social Security numbers, driver's license numbers, other government ID numbers, financial account or card numbers, medical information and health insurance information among the information involved. Of the 607 reports Texas posted in 2026 up to November 10, it is the 98th largest by Texans affected; the Texas ranking has the largest. The figure counts Texans only.

What is Pyramid offering people who got a letter?

Twelve months of complimentary credit and CyberScan monitoring through IDX, with an enrollment deadline of May 25, 2026. The company says it cannot enroll anyone itself; each person had to sign up with the code on their letter. That deadline has passed. A credit freeze with Equifax, Experian and TransUnion is free and still open to anyone, and the guide to credit monitoring offers compares this offer with others in the log. Questions can go in writing to Pyramid at 30 Rowes Wharf, Suite 530, Boston, MA 02110, the address on the letter.

Other hotel company notices in the log

Magna Hospitality Group is another hospitality company in this log with a 2026 notice: it told California on October 13, 2026 that files were copied from its network in May 2025.

What the record leaves open

• How the attacker got into Pyramid's network, and whether it was ransomware.
• Why the first investigation found no sign of data impact before September 30, 2025.
• How many of the 139,899 are former employees, and in which states.