Shoreline Sightseeing Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 29, 2026, the ransomware group dragonforce listed Shoreline Sightseeing on its leak site and claimed to have carried out a ransomware attack that included the exfiltration of internal files. The number of people whose information may be involved is not known, and the company has not issued a public statement confirming the incident or detailing its scope. The practical stakes center on the possibility that files containing customer or operational records have left the organization’s control. Without Reported Details on the contents or volume of data, individuals who have booked tours, provided contact information, or interacted with the company in other ways have no immediate way to assess their exposure.

Inside the incident

The only confirmed public information is the listing itself. Dragonforce posted Shoreline Sightseeing on its site on May 29, 2026, stating that internal files had been taken during a ransomware operation. No figure for the number of affected individuals has been released, and no description of the specific files or the method of initial access has been disclosed. The organization has not confirmed or denied the claims.

Who is dragonforce?

Dragonforce is a ransomware group that publishes victim names on a dedicated leak site when ransom demands are not met. The group typically claims to have encrypted systems and removed data beforehand, then uses the site to pressure organizations by threatening to release the material. Listings by the group are treated as unverified claims until independently confirmed by the victim or through other reliable reporting.

Who is Shoreline Sightseeing?

Shoreline Sightseeing operates guided boat tours and water taxi services on the Chicago River and Lake Michigan. Established in 1939, the company runs the largest fleet of its kind in the city and offers routes such as the Architecture River Tour, Skyline Lake Cruise, and Fireworks Tour. It sells tickets directly to the public and participates in multi-attraction passes such as Chicago CityPASS. Like other tourism operators, it routinely collects names, contact details, payment information, and booking records from customers.

What was likely exposed

The listing states only that internal files were exfiltrated. No inventory of file types or data categories has been published. Organizations in the tourism sector commonly store customer names, email addresses, phone numbers, payment card details, booking histories, and employee records. The exact contents of the exfiltrated material remain unconfirmed.

Why it matters

Exfiltrated internal files can contain personal identifiers that enable targeted phishing, account takeover attempts, or identity fraud if they include payment or contact data. For the organization, the incident creates operational disruption from any ransomware deployment and potential regulatory obligations under data-protection rules that apply to customer information. The absence of a confirmed count of affected individuals leaves both customers and the company without a clear picture of the incident’s reach.

Were you affected?

Individuals who have purchased tickets or provided personal information to Shoreline Sightseeing should monitor their email and financial accounts for unusual activity. A practical first step is to run a free exposure scan of the email address used with the company against known breach datasets. Organizations that hold customer data are expected to notify affected individuals once the scope of any exposure is determined.

AICompiled with AI assistance from public sources and published under our editorial standards.