casa-andina.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On August 29, 2023, the Peruvian hotel chain casa-andina.com was listed by the LockBit3 ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further operational details have not been disclosed.

For guests, employees, and partners of a hospitality brand that holds reservation, contact, and operational records, a claimed ransomware listing raises practical questions about what may have left the organisation’s systems and what steps those potentially exposed can take while official confirmation stays limited.

What happened

According to the available record, casa-andina.com appeared on a LockBit3 leak-site listing dated August 29, 2023. The group’s claim centres on a ransomware attack in which internal files were exfiltrated. No public figure has been given for the volume of data, the precise date the intrusion began or ended, or the initial access method. The number of individuals affected is listed as unknown. Beyond the assertion that internal files were taken, the contents of those files and any subsequent publication or auction by the group have not been detailed in the facts provided. The listing itself should be treated as an unverified claim by the threat actor unless independently confirmed by the organisation or authorities.

Inside lockbit3

LockBit3 is a well-documented ransomware operation that has functioned as a Ransomware-as-a-Service (RaaS) brand. Affiliates typically gain access to victim networks, move laterally, exfiltrate data, and deploy encryption, after which the operators pressure the victim by threatening to publish stolen material on a dedicated leak site. The group has historically targeted organisations across many sectors and geographies, using double-extortion tactics that combine operational disruption with the risk of data exposure. Public reporting on LockBit3 has described automated negotiation portals, countdown timers on leak pages, and periodic law-enforcement actions against infrastructure and affiliates; those general patterns are established in open sources. Nothing in the present facts attributes specific additional statements by LockBit3 about casa-andina.com beyond the listing and the claim of internal-file exfiltration.

About casa-andina.com

Casa Andina is a Peruvian hotel chain founded in February 2003. Its public description emphasises providing guests with a travel experience that reflects the architecture, decoration, gastronomy, activities, and music of each destination where it operates. As a multi-property hospitality company, it sits in a sector that routinely processes guest reservations, payment details, identity and contact information, loyalty or corporate-account data, and internal operational records covering staff, suppliers, and property management. A breach affecting such an organisation is consequential because the same systems that support bookings and guest services often concentrate personal and commercial data that can be reused for fraud, phishing, or competitive harm if they leave controlled environments.

What data was at risk

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data types—such as guest names, passport or ID numbers, payment card data, employee records, or contracts—has been publicly named. Organisations of this kind typically hold reservation databases, customer-relationship records, human-resources files, and financial or supplier documentation. Because the exact contents remain undisclosed, it is not possible to confirm which of those categories, if any, were included in the claimed exfiltration. Readers should treat any assertion about particular data elements as unconfirmed until the organisation or independent investigators provide a verified accounting.

Why it matters

If internal files did leave the network, individuals whose details appear in guest, employee, or partner records could face targeted phishing, identity misuse, or unwanted contact. Even without confirmed publication, the mere claim of exfiltration can prompt criminals to craft convincing lures that reference the hotel brand or recent stays. For the organisation, a ransomware incident can disrupt booking and property systems, impose recovery and notification costs, and damage trust among travellers who expect hospitality brands to safeguard personal information. Because the scale of impact is unknown, the prudent assumption for anyone who has stayed at, worked for, or contracted with Casa Andina properties is that limited personal or business data may have been among the internal material referenced in the claim, pending clearer disclosure.

What to do if you're exposed

Monitor financial and email accounts for unexpected messages that reference Casa Andina stays, refunds, or account updates, and treat unsolicited links or attachments with caution. If you regularly used the same password on hotel or travel sites, change it and enable multi-factor authentication where available. Consider placing fraud alerts with credit bureaus if you believe identity documents or payment details could have been involved, and retain booking confirmations so you can verify any claimed transaction. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets, which provides an additional signal while official details about this incident remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.