SUNSETWORLDRESORTS Listed by morpheus Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
SUNSETWORLDRESORTS was listed by the morpheus ransomware group on January 29, 2026, after internal files were exfiltrated in a ransomware attack. Because the number of individuals affected has not been disclosed, anyone who has stayed at or done business with SUNSETWORLDRESORTS should check the company’s notices and consider protective steps such as monitoring accounts and changing passwords.
Inside the incident
The incident came to light on January 29, 2026, when the ransomware group morpheus listed SUNSETWORLDRESORTS on its site. The group claims to have exfiltrated internal files during a ransomware attack. No figure for the number of individuals affected has been released, and details on the timing or method of the intrusion remain undisclosed.
Inside morpheus
Morpheus is a ransomware operation that typically gains access to corporate networks, exfiltrates data, and then deploys encryption. The group maintains a leak site where it lists organizations that have not met its demands. Its listing of SUNSETWORLDRESORTS constitutes a claim by the group; independent confirmation of the data's authenticity or volume has not been made public.
SUNSETWORLDRESORTS and its sector
SUNSETWORLDRESORTS operates as part of Sunset World Group, a Mexican family-owned business with reported revenue of $593 million and a website at sunsetworldresorts.com. The company traces its origins to early developers of Cancun tourism. Organizations in this sector routinely manage reservations, guest profiles, payment processing, and operational records across multiple properties.
What data was at risk
The only detail released states that internal files were exfiltrated. Specific categories of information have not been disclosed. Hospitality companies of this type commonly hold names, contact details, booking histories, and financial transaction data, yet the exact scope in this case stays unconfirmed.
Why it matters
Exposure of internal files can lead to follow-on fraud, targeted phishing, or misuse of personal identifiers held by the company. For the organization, the incident adds operational disruption and potential regulatory scrutiny typical of ransomware events in the tourism sector.
Were you affected?
Check any communications from Sunset World Resorts and monitor accounts tied to the company for unusual activity. Review bank and credit statements for unauthorized transactions. Readers can run a free exposure scan of their email to check whether their information has surfaced in known breach data.
- Change passwords for any accounts linked to the resort and enable multi-factor authentication.
- Place fraud alerts with credit bureaus if financial details were involved.
- Retain records of any suspicious messages received after January 2026.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Hansa Research Group Pvt. Ltd Listed by morpheus Ransomware GroupDelegal Poindexter & Underkofler, P.A. Listed by morpheus Ransomware GroupHDFC FUND Listed by morpheus Ransomware Group3I INFOTECH Listed by morpheus Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the SUNSETWORLDRESORTS Listed by morpheus Ransomware Group →
Publicly posted by morpheus — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.