Travel of America Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 13, 2026, the ransomware group dragonforce listed Travel of America on its leak site and stated that it had exfiltrated internal files from the company during a ransomware operation. No information has been released about the number of individuals affected or the precise contents of the material taken. The incident fits a pattern seen across multiple industries in which threat actors combine encryption of systems with the removal of data to increase pressure on targeted organisations. Public details remain limited to the group’s listing and the general description of internal files.

Inside the incident

Travel of America was added to dragonforce’s leak site on April 13, 2026. The group claims the action followed the exfiltration of internal files during a ransomware attack. No further technical details, such as the date of intrusion, the volume of data, or the encryption status of systems, have been made public. The number of people whose information may be involved is also unknown.

Who is dragonforce?

Dragonforce is a ransomware operation that follows the double-extortion model common among current threat groups. It typically encrypts victim systems and removes copies of data, then uses a leak site to publish samples or file listings when ransom demands are not met. The group has appeared in multiple public reports describing similar listings against organisations in various sectors. Its listing of Travel of America constitutes an unverified claim by the actor.

Travel of America and its sector

Travel of America provides luxury ocean, river, and expedition cruises along with hotel, resort, guided-tour, and custom land-arrangement services. The company serves both individual and group clients and maintains loyalty programs and personalised itineraries. Organisations of this type routinely collect and store customer booking details, payment information, passport data, and internal operational records to coordinate complex travel logistics.

What data was at risk

The only information released states that internal files were exfiltrated. No inventory of specific file types or data categories has been published. Companies in the travel sector commonly hold reservation records, financial details, identity documents, and correspondence; however, whether any of these categories were present in the material allegedly taken from Travel of America remains unconfirmed.

The real-world impact

Exposure of internal files can create operational disruption for the organisation and may lead to follow-on fraud or targeted scams against customers if personal details are later released. For individuals, the primary risks involve misuse of any identity or payment information that might appear in the files. The absence of confirmed data categories means the scale of potential harm cannot yet be assessed.

If your data was in this claimed breach

Monitor account statements and travel-related services for unusual activity. Enable multi-factor authentication on any accounts linked to the company and consider requesting new payment cards if card details were stored. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.