BALNEARIO DE MONDARIZ Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 19, 2025, the ransomware group known as qilin listed BALNEARIO DE MONDARIZ on its leak site, claiming the Galician hotel and thermal spa complex as a victim of a ransomware attack in which internal files were exfiltrated. Public detail remains limited: the number of people affected is unknown, and no further confirmation of the claim or the precise scope of the incident has been disclosed.

The listing matters because organisations of this type hold guest records, employee information and operational data. Even when exact contents stay unconfirmed, a claimed exfiltration of internal files raises practical questions for anyone who has stayed, worked or done business with the complex.

Inside the incident

According to the available record, BALNEARIO DE MONDARIZ was listed by qilin on May 19, 2025. The group asserts that internal files were taken during a ransomware attack. No public information has been released about the date the intrusion began, how access was obtained, whether encryption was deployed, or whether any ransom demand was made or paid. The number of individuals whose data may be involved is listed as unknown. Beyond the claim of exfiltrated internal files, the volume, categories and sensitivity of the material remain undisclosed. At present the incident rests on the group's leak-site listing; independent verification has not been reported.

Who is qilin?

Qilin is a ransomware operation that has been active for several years and is widely documented as a ransomware-as-a-service group. It typically follows a double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not received. The group has previously claimed responsibility for attacks on organisations across multiple sectors and countries, often posting samples or file lists to pressure victims. Its public communications are limited to the leak-site entries themselves; statements about any specific victim should therefore be treated as claims rather than independently Reported Facts. In this case the listing of BALNEARIO DE MONDARIZ is presented solely as qilin's assertion.

Who is BALNEARIO DE MONDARIZ?

BALNEARIO DE MONDARIZ is a hotel and thermal complex located in Galicia, Spain. Public descriptions characterise it as a resort offering 194 hotel rooms, a modern spa that uses mineral-medicinal waters, the Palacio del Agua spa facility of approximately 3,000 square metres, an 18-hole golf course and related leisure amenities. As a hospitality and wellness operator it routinely processes guest reservations, payment details, health-related spa preferences, staff records and supplier contracts. A breach at such an organisation is consequential because the data it holds can include personally identifiable information of visitors and employees, financial transaction records and internal operational documents. Even without Reported Details of what was taken, the nature of the business means any compromise of internal files carries potential privacy and operational impact.

The information in question

The only data type named in the public record is "internal files exfiltrated in ransomware attack." No further breakdown—such as guest databases, employee records, financial documents or medical-related spa notes—has been disclosed. Organisations of this kind typically store reservation systems, contact details, payment card or invoice data, loyalty or membership information, staff personnel files and operational correspondence. Because the exact contents remain unconfirmed, it is not possible to state which of these categories, if any, were among the files claimed by qilin. Readers should treat any specific data-type assertions beyond the published summary as unverified.

What's at stake

For individuals, the principal risks are identity misuse, targeted phishing or social-engineering attempts that exploit knowledge of a past stay or booking, and potential exposure of contact or payment details if such material was present. For the organisation the stakes include disruption of guest services, regulatory notification obligations under data-protection rules, reputational harm and the cost of investigation and remediation. Because the scale of the claimed exfiltration and the precise data types are unknown, the concrete impact cannot yet be quantified; the uncertainty itself, however, creates ongoing exposure for anyone whose information may have been held in the affected systems.

What to do if you're exposed

If you have stayed at, worked for or otherwise shared personal details with BALNEARIO DE MONDARIZ, treat the listing as a prompt for basic precautions. Monitor bank and card statements for unfamiliar charges, enable multi-factor authentication on email and financial accounts, and be alert to unsolicited messages that reference a stay or booking. Change passwords that may have been reused across services. Consider placing a fraud alert with credit-reference agencies if you believe financial data could be involved. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan provides an additional, independent signal of prior compromise and can guide further protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.