Aman data breach: 215K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-05-01
In April 2026, the ultra-luxury hotel brand Aman was named by ShinyHunters as the target of a "pay or leak" extortion campaign, with the data allegedly obtained from their Salesforce CRM. The data was subsequently leaked publicly and contained over 200k unique email addresses. Whilst not present on all records, the data also included genders, physical addresses, phone numbers, nationalities, dates of birth, spouse names and VIP status codes. Exposed data: dates of birth, email addresses, genders, language preferences, names, nationalities, phone numbers, physical addresses, spouses names, vip statuses. The breach dates from Apr 20, 2026; Have I Been Pwned loaded it on May 1, 2026.
What to do
- If you had a Aman account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
