Magna Hospitality Group is a privately held hotel real estate investment, development and management firm based in Warwick, Rhode Island. It has begun notifying individuals that an unauthorized actor copied files from its network during a three-day intrusion in May 2025. The company filed a breach notice with the California Attorney General on October 13, 2026, nearly 17 months after it detected the activity. Filings tracked by AcidPeak also list a Massachusetts notice covering 1,727 residents. The company has not published a total number of people affected. The Qilin ransomware group claimed the attack in October 2025 and says it took 385 GB of data. That figure comes from the attacker alone, and Magna has not confirmed it.
A note on sourcing: none of the reports available for this brief are primary documents. The details below come from law firms, breach trackers and aggregators that summarised the company's California AG filing. Where they disagree, we say so.
What Happened
Several trackers (Class Action U, Almeida Law Group, AcidPeak, ClaimDepot) summarised the template notice letter Magna filed in California. They give a consistent timeline:
- May 22 to May 24, 2025: An unauthorized actor gained access to "certain systems" on Magna's network and copied files.
- May 24, 2025: Magna detected suspicious activity and started an investigation.
- October 22, 2025: Qilin listed Magna Hospitality Group on its Tor-hosted leak site and claimed 385 GB of data (ClaimDepot, Almeida Law Group). That is about five months after the intrusion window.
- October 13, 2026: Magna filed notices with the California Attorney General and, according to AcidPeak, with Massachusetts, and began mailing letters to affected individuals.
Magna says it notified federal law enforcement, added more cybersecurity measures, and is offering free Experian IdentityWorks credit monitoring and identity theft protection. In the filed template letter, the length of that coverage and the enrollment deadline were left as blank merge fields (Class Action U, Almeida Law Group).
The incident is described differently by different sources. ClaimDepot calls it a "ransomware attack on its computer systems." The notice as summarised by Class Action U, Almeida and AcidPeak describes only unauthorized access and file copying. It does not mention encryption or ransomware. The ransomware label comes from Qilin's leak-site claim. Whether Magna's systems were actually encrypted, or this was a data-theft-only extortion, has not been publicly confirmed.
The 17-month gap between detection and notification stands out. The company's stated reason is a file review to find what data was involved and whose it was. That kind of review often takes a long time after large exfiltrations. Even so, Qilin's public claim came almost a year before individuals were told.
What Was Taken
The scope of the data is unclear, and the reports conflict:
- Volume: 385 GB, according to Qilin's leak-site post as reported by ClaimDepot and Almeida Law Group. Magna has not confirmed the figure.
- Confirmed data types: Names are the only data element that sources agree is confirmed (ClaimDepot, Almeida Law Group). Class Action U and Almeida both report that the data-type field in the California filing is an unfilled template placeholder. Cole & Van Note lists the data types as "Unknown."
- Contested data types: ClaimDepot's page has a sidebar listing Social Security numbers, dates of birth, addresses, government IDs, medical information and financial information. ClaimDepot's page for an unrelated breach (Secure Health Plans of Georgia) shows the identical list. That suggests it is a generic site template, not a finding specific to Magna. We do not treat these categories as confirmed.
- Attacker claims: Almeida Law Group reports that Qilin claimed to have exfiltrated financial data and personal data on employees. Nobody has independently verified this.
- Affected count: No total has been disclosed. AcidPeak reports 1,727 Massachusetts residents. Cole & Van Note reports more than 500 California residents, which is consistent with California's filing threshold.
Magna's workforce is one plausible exposed group. Accounts of its size differ widely. Almeida Law Group says Magna runs more than 40 hotels with over 10,000 rooms and employs about 1,500 people across its portfolio. A LinkedIn company-profile snippet lists 20 to 30 employees. That figure probably counts corporate headquarters staff only, but neither source settles the question.
Why It Matters
Hotel operators hold sensitive HR data at scale. Almeida Law Group reports that Magna operates properties under the Hilton, Marriott, IHG, Hyatt, Choice and Starwood brands. Franchise-model operators usually employ the hotel workforce directly, which means a central office holds payroll, tax and onboarding records for hundreds or thousands of staff. If Qilin's claim about employee data is accurate, a breach at that office reaches all of them.
Qilin keeps targeting mid-market private firms. Qilin (also tracked as Agenda) has been one of the most active ransomware-as-a-service operations. It regularly hits privately held companies that have small security teams but valuable data. A firm with about 40 hotels and a lean corporate IT function fits that profile.
The leak site came before the notice. Qilin posted its claim almost a year before individuals were notified. For about 12 months, the people affected had no official warning, while whatever Qilin published or sold could be used for phishing, payroll diversion fraud or identity theft. Defenders and regulators should note that a leak-site listing is often the first public sign of a breach.
The Attack Technique
Magna has not disclosed how the attacker got in, which systems were affected, or whether it paid a ransom. Nothing in the available reporting identifies the initial access vector.
For context only, and without attributing any of it to this incident, Qilin affiliates have historically used:
- Compromised credentials against VPN and remote-access portals that lack multi-factor authentication
- Exploitation of known vulnerabilities in internet-facing edge devices (firewalls, VPN appliances, remote access gateways)
- Phishing for initial footholds
- Theft of credentials from backup infrastructure, and deletion of backups before encryption
- Double extortion: exfiltrating data, then encrypting, and threatening a leak-site publication
The three-day window from May 22 to May 24, 2025 is short. It points to an operator who found and staged data quickly, or one who already had good knowledge of the environment through stolen credentials or an access broker.
What Organizations Should Do
- Enforce phishing-resistant MFA on every remote access path. That includes VPNs, RDP gateways, Citrix and vendor support portals. Hospitality groups often give remote access to property-level managers and third-party management companies, so audit those accounts first.
- Patch and inventory edge devices aggressively. Internet-facing firewalls and VPN appliances are a favourite entry point for Qilin-style affiliates. Treat critical vulnerabilities in them as same-week fixes.
- Separate HR and payroll data from general file shares. Employee PII, tax forms and onboarding documents should not sit on broadly accessible shares where one compromised account can reach them. Apply least privilege and alert on bulk reads.
- Detect exfiltration, not just encryption. Watch for large outbound transfers, use of tools like Rclone, MEGAsync or WinSCP, and unusual archive creation. A 385 GB transfer over two or three days should trip egress monitoring.
- Harden and isolate backups. Use immutable or offline backups, keep backup credentials separate from the domain, and test restores regularly.
- Monitor leak sites and shorten notification timelines. Subscribe to ransomware leak-site monitoring for your organization and key vendors. When a claim appears, start data-mapping right away. Do not leave affected individuals unaware for a year.
Sources: Magna Hospitality Data Breach: 385 GB of Data Stolen | Magna Hospitality Group data breach notice, Oct 13, 2026 AcidPeak | Magna Hospitality Group Data Breach Lawsuit - Class Action U | Magna Hospitality Group Data Breach Investigation Almeida Law Group | Magna Hospitality Group Data Breach Investigation - Cole & Van Note... | Jay Kooger | Manchester Airports Group attack: Millions of holidaymakers urged t... | Secure Health Data Breach Compromises Protected ...