Aman Resorts (aman.com) Listed by shinyhunters Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In the current threat landscape, ransomware groups routinely list targeted organizations on public leak sites to amplify pressure, often claiming access to customer or operational data from sectors that hold sensitive personal records. Such listings have become a standard tactic, regardless of whether the underlying compromise has been independently verified. On 19 April 2026, Aman Resorts (aman.com) appeared on a leak site maintained by the group shinyhunters. The listing states that internal files were exfiltrated during a ransomware attack and references more than 500,000 Salesforce records containing personally identifiable information. The group’s accompanying message sets a payment deadline of 21 April 2026 and warns of further leaks and operational interference if demands are not met. The number of individuals affected remains undisclosed.

What happened

The incident was first noted publicly through the group’s leak-site listing dated 19 April 2026, with an update recorded on 18 April 2026. The posting describes the exfiltration of internal files and references a volume of Salesforce records. No independent confirmation of the data volume, the method of initial access, or the scope of any encryption has been made available. The organization has not issued a public statement detailing its response.

The group behind it: shinyhunters

Shinyhunters is a ransomware-affiliated actor that maintains a public leak site where it lists organizations it claims to have targeted. The group typically posts excerpts of data and sets deadlines for payment, after which it threatens to release additional material. Its activity has been documented across multiple sectors in recent years, with listings often accompanied by demands for contact within short time frames. In this case the group claims responsibility for the Aman Resorts listing and the associated data.

Aman Resorts (aman.com) and its sector

Aman Resorts operates a collection of luxury properties and maintains the website aman.com for reservations, guest services, and operational management. Organizations in the luxury hospitality sector routinely process booking details, payment information, loyalty-program records, and passport or identification data. A listing involving such an operator draws attention because these datasets can contain information that remains valuable for identity-related misuse over extended periods.

What data was at risk

The listing refers to internal files exfiltrated in a ransomware attack and specifically mentions over 500,000 Salesforce records containing personally identifiable information. The precise categories of data, their format, or whether additional systems were accessed have not been confirmed by any party outside the listing itself.

What's at stake

Individuals whose records appear in the claimed dataset face the possibility that their contact details, identification numbers, or booking histories could be circulated or misused. For the organization, the listing creates reputational exposure and potential regulatory scrutiny under data-protection frameworks that apply to hospitality operators handling guest information. The absence of Reported Details on the number of affected people limits precise assessment of downstream impact.

What to do if you're exposed

Anyone who has stayed at an Aman property or used aman.com services can treat the listing as a signal to review their personal accounts for unusual activity. Practical first steps include monitoring bank and credit-card statements, enabling multi-factor authentication on any associated email or loyalty accounts, and requesting a credit report from recognized agencies. Readers can also run a free exposure scan of their email address against known breach datasets to check for prior appearances of their information.

• Change passwords for any accounts linked to the email used with Aman Resorts.
• Watch for unsolicited messages that reference recent travel or bookings.
• Consider placing a fraud alert with credit bureaus if financial details were involved.
• Retain records of any correspondence with the organization regarding the incident.

AICompiled with AI assistance from public sources and published under our editorial standards.