Inca Floats, Inc., doing business under the trade names International Nature & Cultural Adventures and Integrity Galapagos, operates as a specialized adventure travel and expedition outfitter catering to high-end tourists, researchers, and educational groups traveling to remote international destinations, most notably the Galapagos Islands and South America. Because organizing complex, multi-week international expeditions requires comprehensive traveler profiles, the company routinely collects and maintains a vast repository of sensitive personal documentation. To facilitate bookings, international flights, visa processing, dietary restrictions, and emergency medical evacuations, Inca Floats gathers deep personal dossiers on its clientele. This information includes full legal names, passport details, dates of birth, home addresses, contact information, credit card and banking details, emergency contact data, and occasionally specialized health or dietary requirements necessary for remote travel.
In 2025, Inca Floats reported a significant data security incident to the New Hampshire Attorney General's office, alerting consumers that their confidential information may have been accessed by unauthorized third parties. While investigations into travel and hospitality sector breaches typically reveal vulnerabilities such as unsecured booking platforms, compromised administrative credentials, or third-party reservation software flaws, incidents of this nature point to systemic weaknesses in digital infrastructure. Cybercriminals frequently target travel operators because these companies hold a centralized trove of high-value personally identifiable information (PII) and financial credentials, making them prime targets for network intrusions, credential stuffing, or ransomware deployment.
As a result of this security compromise, individuals who booked trips with International Nature & Cultural Adventures or Integrity Galapagos face severe risks regarding the exposure of their personal data. The exfiltration of passport numbers, dates of birth, and Social Security numbers or financial account details creates an immediate danger of identity theft, fraudulent credit card applications, and unauthorized bank account withdrawals. Furthermore, because travel profiles often include emergency contact information and specific medical or dietary disclosures, victims are uniquely vulnerable to targeted phishing scams and medical impersonation fraud. Cybercriminals can weaponize these details to execute sophisticated social engineering attacks, tricking victims into handing over additional sensitive assets or authentication codes.
Under New Hampshire data protection laws and general consumer protection statutes, businesses like Inca Floats, Inc. have an affirmative legal duty to implement and maintain reasonable security procedures to safeguard consumer data from unauthorized access or exfiltration. The occurrence of a data breach of this scale strongly implies a failure in these mandated cybersecurity protocols, such as inadequate data encryption, weak network access controls, or a failure to timely patch known software vulnerabilities. Under the Federal Trade Commission Act and state privacy frameworks, companies that collect high-risk travel and financial documentation are legally obligated to ensure that their digital environment meets industry-standard security benchmarks, making any preventable breach a potential breach of contract and negligence.
Receiving a formal data breach notification letter from Inca Floats, Inc. dba International Nature & Cultural Adventures and dba Integrity Galapagos serves as a legal admission that your confidential records were compromised while under their care. Under modern class action jurisprudence, the receipt of such a letter—and the resulting imminent threat of identity theft—provides affected consumers with the legal standing necessary to participate in a class action lawsuit. Participating plaintiffs do not need to demonstrate that financial fraud has already occurred to seek legal recourse and demand accountability; the increased risk and anxiety of compromised data are sufficient. Our law firm is investigating potential legal claims on a contingency fee basis, meaning there are never any out-of-pocket costs or hourly fees for class members, and we only recover fees if a successful recovery is secured on your behalf.