Bayu Buana Travel Listed by crypto24 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations that hold customer and operational data, using leak-site listings to pressure victims after claiming to have stolen files. Against that backdrop, Bayu Buana Travel was named on 27 October 2025 in a listing by the group known as crypto24.

Public detail remains limited: the number of people affected is unknown, and the precise contents of the material have not been independently confirmed. What is known is that the group claims internal files were exfiltrated during a ransomware attack. For customers, staff and partners of a travel company, even an unverified claim of this kind raises practical questions about personal and booking-related information.

Inside the incident

According to the available record, Bayu Buana Travel was listed by the crypto24 ransomware group on 27 October 2025. The listing asserts that internal files were exfiltrated in a ransomware attack. No further technical details—such as the initial access method, the duration of any intrusion, the volume of data taken, or whether systems were encrypted—have been disclosed in the public summary.

The number of individuals potentially affected is listed as unknown. No independent confirmation of the group’s claims has been reported, and no statement from the organisation itself is included in the facts provided. As with many ransomware listings, the public record at this stage consists primarily of the threat actor’s assertion rather than verified forensic findings.

Who is crypto24?

Crypto24 is a ransomware operation that has appeared in public reporting as a group that practices double extortion: encrypting systems while also claiming to steal data and threatening to publish it if a ransom is not paid. Like other groups in this category, it maintains a leak site on which it posts victim names and, in some cases, samples or larger sets of allegedly stolen material.

Public accounts of crypto24 describe typical ransomware tactics—phishing or exploitation of exposed services for initial access, followed by lateral movement, data theft and deployment of encryption. The group’s listings are claims made by the actors themselves; they are not independent verification that a breach occurred exactly as described. In the present case, the facts state only that Bayu Buana Travel was listed and that the group claims internal files were exfiltrated. No additional statements attributed specifically to crypto24 about this victim appear in the record.

About Bayu Buana Travel

Bayu Buana Travel operates in the travel sector, arranging bookings, itineraries and related services for customers. Organisations of this type routinely process personal details, contact information, travel documents, payment-related data and internal operational records. Even when the exact scope of any incident is unconfirmed, a claimed compromise of internal files at a travel company is consequential because such files can contain both customer and corporate information.

A listing of this kind can affect trust, regulatory obligations and day-to-day operations. Customers may need to consider whether their booking or identity data could be involved; staff and partners may face similar questions about internal records. The absence of confirmed numbers or a detailed inventory of files does not remove the need for careful attention to the claim.

The information in question

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No specific data types—such as customer names, passport numbers, payment card details, employee records or financial documents—are enumerated. Exact contents therefore remain unconfirmed.

Travel companies typically hold customer booking histories, contact and identity information, payment or billing data, and internal documents relating to suppliers, staff and operations. Whether any of those categories were among the files crypto24 claims to have taken is not established by the public record. Readers should treat the group’s assertion as an unverified claim until more detailed, independent information becomes available.

What's at stake

For individuals, the main risks associated with a travel-related data claim include possible misuse of personal or booking information for phishing, identity fraud or social-engineering attempts that reference real travel details. Even if the precise files are unknown, people who have used the company’s services may reasonably decide to monitor accounts and communications more closely.

For the organisation, a ransomware listing can bring operational disruption, reputational pressure, potential regulatory scrutiny and the cost of investigation and remediation. Because the number of people affected is listed as unknown and the data types are not further specified, the full scale of impact cannot yet be assessed from public sources alone.

If your data was in this claimed breach

If you have been a customer, employee or partner of Bayu Buana Travel, treat the listing as a prompt for basic precautions rather than confirmed proof that your information was taken. Practical first steps include:

• Review recent account statements and travel bookings for unexpected activity.
• Change passwords on any accounts that reuse credentials associated with the company, and enable multi-factor authentication where available.
• Be alert to phishing messages that reference travel plans, invoices or personal details you may have shared with the firm.
• Consider placing fraud alerts with relevant credit or identity-protection services if you believe sensitive identity data could be involved.

You can also run a free exposure scan of your email address to check whether it has already appeared in other known breach data sets. Public detail on this particular incident remains limited; further verified information, if it emerges, will clarify the true scope.

AICompiled with AI assistance from public sources and published under our editorial standards.