Inca Floats Inc, et al Data Breach — Class Action Review

Inca Floats Inc, et al operates within the specialized travel and tourism sector, known for curating complex, high-end expedition cruises and adventure travel packages, particularly focusing on remote and exotic destinations like the Galapagos Islands and South America. Because of the bespoke and logistically demanding nature of their services, the company routinely collects and maintains extensive personal data from its affluent clientele, prospective travelers, and corporate partners. This information often includes not only standard contact details and billing information, but also detailed passport details, emergency contact data, specific dietary and medical requirements for remote travel, and in many instances, financial documents or credit card information necessary to process expensive, multi-person international itineraries.

In 2025, Inca Floats Inc, et al reported a significant cybersecurity incident to the Indiana Attorney General, raising serious concerns among consumers whose private information was entrusted to the company. While the exact vectors of the attack continue to be evaluated, incidents affecting specialized travel and hospitality operators frequently involve unauthorized access to centralized booking databases, compromise of legacy web applications, or third-party vendor vulnerabilities that expose sensitive customer management systems. Cybercriminals actively target travel-related organizations because their digital environments often store rich troves of personally identifiable information alongside high-value financial transaction records, making them lucrative targets for credential stuffing, ransomware deployment, and subsequent data exfiltration.

The data compromised in the Inca Floats breach exposes victims to severe, multi-faceted risks. The exposure of passport numbers and government-issued identification details creates an immediate danger of identity theft and fraudulent passport applications. When combined with full names, dates of birth, and home addresses, malicious actors can easily open fraudulent lines of credit, apply for loans, or execute targeted phishing schemes. Furthermore, because travel planning often requires travelers to disclose emergency contacts, family details, and even specific health or dietary constraints, the exposure of these specialized records compromises personal privacy and leaves consumers vulnerable to sophisticated social engineering attacks tailored to exploit their upcoming travel plans or personal backgrounds.

Under Indiana state data protection laws and general consumer protection standards, Inca Floats Inc, et al had a strict legal obligation to implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information they held. The occurrence of a data breach compromising sensitive consumer files strongly indicates potential failures in network segmentation, encryption protocols, access controls, or vendor oversight. Under the Indiana Identity Theft Prevention Act and related statutes, companies that fail to secure sensitive personal data or delay providing timely, transparent notice to affected consumers may be held legally accountable for negligence and breach of implied contract.

Receiving a data breach notification letter from Inca Floats Inc, et al is a formal acknowledgment that your private information was compromised due to corporate security shortcomings. Legally, this notification serves as the foundation for establishing standing to participate in a class action lawsuit aimed at holding the company accountable and securing necessary protections, such as credit monitoring services and financial compensation. You do not need to prove that financial fraud has already occurred to join an action. Our law firm handles these data breach cases on a strict contingency fee basis, meaning you pay nothing out of pocket and owe no attorney fees unless we successfully recover compensation on your behalf.