Embargo ransomware group lists https://www.lagoonpark.com/ on its leak site

• Ransomware group: Embargo
• Country: United States
• Sector: Hospitality
• Announcement date: March 31, 2026

The threat actor group known as Embargo has listed lagoonpark.com on its leak site, claiming to possess a massive amount of data belonging to the organization. This announcement, made on March 31, 2026, marks a significant escalation in the group's activity against the targeted entity.

The details of the claim

According to the announcement posted on the group's platform, the Embargo group claims to have successfully infiltrated the systems of lagoonpark.com. The threat actor asserts that they have obtained a total of 6 TB of data from the institution's internal systems. The timing of the claim coincides with the date of the alleged attack, which was also recorded as March 31, 2026.

To increase the pressure on the victim, the group has implemented a tactic often seen in modern cyber extortion campaigns. The leak site announcement includes countdown timers designed to create a sense of urgency. These timers are set for the release of a 100 GB data pack as well as the release of the entire dataset. Such tactics are characteristic of double extortion, where attackers not only encrypt systems to disrupt operations but also threaten to leak sensitive information to coerce the victim into paying a ransom.

Data involved in the incident

While the group has made significant claims regarding the volume of information stolen, specific details regarding the nature of the alleged leaked data have not been provided. The announcement does not specify the types of files or the categories of information contained within the breach, other than the total size of 6 TB.

• Total claimed data size: 6 TB

About Lagoon Amusement Park

Lagoon Amusement Park is a historic family-owned amusement park located in Farmington, Utah. Operating since 1886, the park is a long-standing institution in the hospitality sector. It is widely recognized for its wide variety of roller coasters and its diverse range of entertainment attractions provided to visitors.

Potential impact and industry implications

This incident may pose significant risks to the institution's operational continuity and customer trust. Depending on the nature of the leaked data, the exposure of employee or customer information could lead to identity theft and targeted phishing attacks. Because the institution is based in the United States, the incident may trigger legal processes under state-level data breach notification laws, which govern how organizations must report such incidents to the public and regulators.

In the hospitality sector, such breaches can be particularly damaging due to the high volume of personal and financial information processed to facilitate bookings and park visits. When organizations face these types of threats, common defensive steps include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training for staff to prevent initial access via phishing.

The use of countdown timers and partial data leaks is a method used by groups to exert maximum pressure on an institution. Public information regarding the specific methods and capabilities of the Embargo group remains limited, making it difficult to assess the full scope of their operational patterns beyond this specific event.