BYODRansomware VictimHospitality

First and Final Warning - IHG Hotels & Resorts (Estate)

Here are some sample files for you and the public to see. Let's actually resolve this situation before we have to escalate it in ways we don't want to have to do. Make the right choice, we're not going to warn you again. | ORIGINAL MESSAGE: Nice LDAP Binding Password being '123'. Rotating things won't really save you casue it's not hard to hop back on your network. Anyways, we now have; Customer Data, AWS Keys, Full Access to CyberArk, Complete Employee PII, Booking information included but not limited to, guest name, billing address, company, rate code, room charges, taxes, spend, property & stay dates. We also have the loyalty data store. Additionally we have reservation and payment ledgers for the folio reservation (guest name, address, phone, email, arrival and departure, rate, property) with Access to the AD + All Financial Records. This affects the big names such as Six Senses, Holiday Inn, Holiday Inn Express, Staybridge Suites, Garner, Candlewood, Crowne Plaza, Mayfair Hotel, etc etc you can pick up what we are putting down at this point. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.

Incident Details

Threat Group
BYOD
Victim / Organization
First and Final Warning - IHG Hotels & Resorts (Estate)
Website / Domain
—
Industry Sector
Hospitality
Country / Region
—
Date Discovered
Thursday, November 5, 2026

What This Listing Means

Posting on BYOD's ransomware leak site typically signals that the threat actor claims to have:

  • ▸Gained unauthorized access to the organization's network via phishing, exposed credentials, or an unpatched vulnerability
  • ▸Exfiltrated sensitive data — potentially including financial records, PII, customer data, or trade secrets
  • ▸Deployed ransomware to encrypt systems and disrupt operations
  • ▸Issued a ransom demand with a deadline to publish all stolen data publicly if unpaid

Open Source Investigation

Google Search LinkedIn Companies

Is This Your Organization?

Security Arsenal provides 24/7 ransomware incident response. We contain active attacks, support ransom negotiation decisions, perform forensic analysis, and recover your data.

Get Emergency ResponseIR Services Overview

Protect Your Organization

← Back to Ransomware Tracker