Aman Data Breach

What happened?

In April 2026, the ultra-luxury hotel brand Aman was named by ShinyHunters as the target of a "pay or leak" extortion campaign , with the data allegedly obtained from their Salesforce CRM. The data was subsequently leaked publicly and contained over 200k unique email addresses. Whilst not present on all records, the data also included genders, physical addresses, phone numbers, nationalities, dates of birth, spouse names and VIP status codes.

When did it happen?

The breach date in the public record is April 20, 2026. The record was added to the catalogue on May 1, 2026 and last updated there on May 1, 2026.

What information was reported as exposed?

• Dates of birth
• Email addresses
• Genders
• Language preferences
• Names
• Nationalities
• Phone numbers
• Physical addresses
• Spouses names
• VIP statuses

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with Aman or used aman.com around April 20, 2026. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.