# Kalahari Resorts and Conventions **Industry:** Hospitality / Indoor Waterpark Resorts **Headquarters:** Wisconsin Dells, WI **Locations:** Wisconsin Dells, WI | Sandusky, OH | Pocono Manor, PA | Round Rock, TX | Spotsylvania, VA (opening November 2026) **Ownership:** Private (Nelson family) --- ## Summary Kalahari Resorts and Conventions has experienced a significant security incident affecting its entire corporate IT infrastructure across all resort locations and the corporate headquarters. A substantial volume of corporate, financial, legal, employee, and guest data has been acquired — totaling over 2.3 million files across 18 corporate servers. We have made multiple good-faith attempts to engage Kalahari Resorts' management in a private and constructive resolution. This page serves as formal notice that the data outlined below is in our possession and will be released progressively in the absence of a satisfactory agreement. --- ## Scope of Compromised Data **Total volume:** 2.3 million+ files across 18 corporate servers **Data size:** 1.4+ terabytes **Coverage:** All five resort locations, corporate headquarters, and the Nelson family's private financial infrastructure ### Infrastructure Compromised Data was obtained from the following systems spanning all resort properties: - **Corporate SQL database servers** — financial, reservations, call recording, revenue management - **Sage ERP accounting system** — complete financial database (326 GB) - **Executive Finance data server** — Executive Offices, Accounting, Payroll, HR, Legal (241 GB) - **Central hospitality management database** — CCMData (110 GB guest/reservation data) - **Corporate file servers** for Wisconsin Dells, Sandusky, Poconos, Round Rock, and Spotsylvania - **Wisconsin Dells corporate file server** — 502,000+ files: Finance, HR, Legal, Executive Offices, Nelson Foundation - **Virginia pre-opening file server** — 484,000+ files: HR personnel files, IT systems, security, executive email archive - **Employee home directories** — 420+ individual user folders across all locations - **Password management infrastructure** — 4,001 credentials decrypted from Pleasant Password Server ### Data Categories | Category | Description | |---|---| | **Financial Records** | Complete Sage ERP accounting databases, monthly consolidated P&L for all four resorts (YTD revenue: $490M), audit workpapers, ADP payroll registers for all locations and subsidiaries (31,000+ payroll files), tax estimates with net income forecasts ($141.8M for 2024), quarterly financial summaries | | **Debt & Financing** | Full debt portfolio: **$751.9 million** across Bank of Wisconsin Dells, Goldman Sachs, Berkadia, VICI, and PNC — with monthly debt summaries, amortization schedules, interest rate details, and covenant documentation. Additional **$608 million** in untapped credit facilities. Private jet financing via PNC Aviation Finance ($8.3M) | | **Nelson Family Wealth** | Company and personal/trust account summaries showing **$213.8 million** in documented liquid assets: $81.3M in company accounts (Bank of WI Dells, Schwab) and $132.5M in personal and trust accounts (Milestone-Schwab, Marquette Associates, Morgan Stanley, Adams Street Partners, E-Trade, IRA accounts). Inter-trust loan schedules between Nelson Family Endowment Trust and Nelson Irrevocable Life Insurance Trust | | **Executive Documents** | Professional property appraisals (HVS, H&LA, USRC) for all resort properties, Goldman Sachs "Project Kiwi" investment agreement, VICI mezzanine commitment ($212M), Virginia development budget ($250M+), beneficial ownership filings (BOIR/Corporate Transparency Act), entity organizational documents for all 15+ affiliated companies | | **Nelson Family Foundations** | Complete records for two charitable foundations — Todd and Shari Nelson Family Foundation and Nelson Family Life Foundation — including bank reconciliations, donor databases with contribution amounts, board meeting minutes, grant documentation, and fundraiser records with individual donor payment details | | **Insurance** | Complete general liability insurance tower spanning five policy years (2021–2026): $106M+ across Travelers, HDI, Arch, Fair American, GA, Vantage. Open claims records and adverse exposure reports. **No cyber insurance policy found in any year.** | | **Legal & Compliance** | Three attorneys' complete working files, active lawsuit documentation, settlement agreements (including guest injury cases), subpoenas, court filings, VA 2023 loan due diligence, Princess Flower Inc. dissolution documents, Corporate Transparency Act filings. Legal hold correspondence and affidavits from senior management | | **Guest Data** | Guest folios, reservation records, injury reports with personal and medical details from waterpark incidents, complaint and compensation trackers for all properties, foodborne illness tracking records | | **Employee PII** | Personnel files including W-2 forms, Social Security numbers, offer letters, background checks (MVR), direct deposit information, and onboarding packages. **134 active Virginia pre-opening employees** with complete personnel files. Drug test documentation, FMLA records, workers' compensation files, performance reviews, disciplinary actions, and termination records. ADP payroll registers for 3,000–5,000+ employees across all locations | | **Executive Communications** | **410,000+ corporate emails** from senior executive Groupwise email archive, spanning years of executive correspondence, financial discussions, legal matters, operational decisions, and confidential business strategy | | **Credentials** | 4,001 passwords decrypted from the corporate password management system, covering domain controllers, hypervisors (131+ VMware hosts), firewalls, switches, wireless controllers, backup systems (Veeam), VPN, cameras, and cloud services across all locations | --- ## Key Financial Figures (Verified from Internal Documents) | Metric | Value | Source | |---|---|---| | Annual revenue (est.) | **$760M — $800M** | Monthly Resort Financial Summary | | YTD EBITDA (8 months) | **$210M** | Monthly Resort Financial Summary | | Net income forecast (2024) | **$141.8M** | Tax Estimates workbook | | Total debt outstanding | **$751.9M** | Monthly Debt Summary | | Available credit facilities | **$608.5M** | Monthly Debt Summary | | Company cash accounts | **$81.3M** | Trust Accounts Summary | | Nelson personal/trust assets | **$132.5M** | Trust Accounts Summary | | Annual debt service | **$68.3M** | Monthly Debt Summary | | Virginia resort budget | **$250M+** | Development Budget | | Virginia 2027 projected revenue | **$167.7M** | VA Projections | | Insurance tower (GL) | **$106M+** | Policy documents | | Cyber insurance | **None found** | 5 years of policy records reviewed | --- ## Consequences of Non-Cooperation ### Regulatory and Legal Exposure Kalahari Resorts operates across five U.S. states (Wisconsin, Ohio, Pennsylvania, Texas, Virginia), each with its own data breach notification requirements. A public disclosure would trigger mandatory notification to: - **State Attorneys General** in all five states - **All affected employees** (5,000+) whose W-2 forms, Social Security numbers, medical records, and drug test results are included - **All affected guests** whose personal information, medical incident details, and financial data are present - **Payment Card Industry (PCI) authorities**, given millions of annual credit card transactions across four resort properties - **Federal regulators**, including HIPAA enforcement for medical records and the FTC for consumer data protection ### Debt and Lender Impact With **$751.9 million** in outstanding debt and **$608.5 million** in untapped credit facilities, Kalahari's financial relationships are extensive and sensitive: - **Goldman Sachs** (PA resort — $350M), **Berkadia** (PA — $350M in 5 tranches), **VICI** (VA — $212M mezzanine commitment), and **Bank of Wisconsin Dells** (primary lender across all entities) would all be notified of a significant data breach - **Material adverse change clauses** in loan agreements could be triggered, potentially accelerating repayment demands - **Cross-default provisions** could cascade across entities that share the Bank of Wisconsin Dells as primary lender - The Virginia resort construction financing ($187.8M from BWD + $212.2M from VICI) would face immediate lender scrutiny 45 days before opening - Goldman Sachs "Project Kiwi" partnership — which has been central to the Virginia development — could be materially impacted ### Personal and Family Exposure The data reveals the complete financial architecture of the Nelson family: - **$132.5 million** in documented personal and trust investment accounts, including specific balances at Milestone-Schwab, Marquette Associates, Morgan Stanley, Adams Street Partners, and other institutions - Inter-trust loan arrangements between Nelson Family Endowment Trust and Nelson Irrevocable Life Insurance Trust - **Two charitable foundations** with complete donor records, bank reconciliations, and board meeting documentation - Beneficial ownership reports showing Todd Nelson's personal Social Security number used as a Tax Identification Number for affiliated entities - Private jet financing details through PNC Aviation Finance ($8.3M) - Real estate holdings and entity structure documents spanning 15+ affiliated companies ### Virginia Resort Opening The upcoming fifth resort in Spotsylvania, Virginia — a **$250M+ development** scheduled to open November 13, 2026 — faces particular risk: - **134 newly hired employees** have complete personnel files (W-2, SSN, background checks, direct deposit) in the compromised data - Construction financing documentation with Bank of Wisconsin Dells and VICI Lendco is included - Pre-opening revenue projections ($167.7M for 2027) and EBITDA forecasts ($83.6M) are fully exposed - A public breach disclosure during the final weeks before opening would impact guest confidence, advance bookings, and lender relationships simultaneously ### Reputational Damage Kalahari Resorts is a family-oriented brand built on trust. The data includes: - Hundreds of **guest injury reports** from waterpark and resort incidents, including medical details - **Foodborne illness tracking records** maintained across all properties - **Employee misconduct investigations** and disciplinary records - **Drug test documentation** for current and former employees - **410,000+ executive emails** containing confidential business discussions, legal strategy, and internal decision-making - **Settlement agreements** from guest injury cases The publication of this material would receive extensive media coverage given the family-friendly positioning of the brand and the sensitivity of waterpark safety records. --- ## Resolution We are prepared to resolve this matter promptly, privately, and professionally. Cooperation will result in: 1. Complete and verifiable deletion of all acquired data 2. Destruction of all decrypted credentials 3. No further access to Kalahari Resorts' systems 4. No public disclosure of any compromised information 5. A technical summary of the vulnerabilities exploited, enabling remediation Simultaneous notifications will be made to relevant state attorneys general, PCI authorities, and financial media outlets. **This page is currently private. Its visibility will change based on the outcome of our communications.** We encourage Kalahari Resorts' decision-makers to treat this matter with appropriate urgency and engage through the secure channel provided.