Incident began 18 Apr 2026; listed on dark web leak site on 14 May 2026. Attackers demanded a 9 BTC (~$1M AUD) ransom. Employee passports and bank records published. Impacted 9 hotels and 350+ staff. ACSC and Tasmanian government notified.