Vacation Myrtle Beach disclosed an incident affecting around 10,750 people, involving Social Security numbers and government identification, with the intrusion dated to 2024 and detection reported in 2025.
Ten thousand people is among the smallest populations in this database. The interval is among the longest.
Three Separate Delays, Compounding
There is the dwell time — over a year between intrusion and detection. There is the investigation period between detection and understanding scope. And there is the notification period after that.
Each is individually explicable. Together they mean a person whose identity documents were taken had roughly two years of exposure before being told, during which the standard remedies were unavailable to them because they did not know they needed them.
Small Organisations Produce Long Intervals
A hospitality operator of this size has no security team, no detection tooling beyond what its systems include by default, and typically learns of an intrusion when a third party tells it.
Our database is dominated by large organisations because their incidents produce large numbers. The distribution of detection failure almost certainly runs the other way, and is invisible for the same reason it is severe: nobody is looking, so nothing is reported.
Compiled from public reporting, listed below. Dates are as reported and the precise detection date is not established. Corrections: corrections@forensicpost.com.
- List of recent data breaches in 2026Bright Defense