Cheval Blanc Randheli Listed by aurora Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Cheval Blanc Randheli was listed by the aurora ransomware group on April 29, 2026, after internal files were exfiltrated in a ransomware attack. An undisclosed number of people may have been affected; check your records and take any recommended steps.
Breaking down the breach
The reported incident is limited to the group’s public listing of Cheval Blanc Randheli. No independent confirmation of the intrusion method, encryption status, or ransom demand has been released. The single data category described consists of 75,855 passport images stored in daily folders within monthly and yearly directories. Among the files referenced are nine passport scans belonging to members of the Qatar royal family, identified by name in the listing. All other aspects of the operation, including whether data was encrypted or further distributed, are not disclosed in available reporting.
Inside aurora
Aurora is a ransomware operator that maintains a public leak site to pressure victims after data exfiltration. The group’s typical approach involves gaining access to corporate networks, copying selected files, and then publishing samples or indexes when negotiations stall. Its listings have previously included hospitality and luxury-service providers, though the precise tactics used against any single target are rarely confirmed beyond the group’s own statements. In this case the group claims the Cheval Blanc Randheli material was obtained during a ransomware attack; that claim has not been independently verified.
Cheval Blanc Randheli and its sector
Cheval Blanc Randheli is a luxury resort operating under the LVMH group and located in the Maldives. Properties of this type routinely collect detailed identity documents from international guests to satisfy immigration, security, and regulatory requirements. Passport data, in particular, is retained for extended periods to support repeat bookings, visa assistance, and compliance audits. A breach involving such records therefore touches both the operational records of a high-end hospitality business and the personal identity documents of its clientele.
What data was at risk
The listing names one primary category: 75,855 passport scan images. Each image is described as containing the full bio-data page, including photograph, name, date of birth, nationality, passport number, machine-readable zone, and signature. The archive spans January 2015 through October 2024. No other categories of data are specified in the available facts, and the exact contents of any additional internal files referenced only as “exfiltrated” remain unconfirmed.
What's at stake
Passport images of this detail can be used for identity verification, account recovery, or fraudulent travel-document applications. Individuals whose scans appear in the archive face a long-term risk that the information could circulate among actors who traffic in travel documents or synthetic identities. For the organisation, the exposure of a decade-long collection of guest records raises questions about data-retention practices and the handling of sensitive identity material collected for operational purposes. The scale of the archive—estimated at 20,000 to 30,000 individuals—means any subsequent misuse would affect a sizable but still unquantified population.
Were you affected?
Individuals who stayed at Cheval Blanc Randheli between 2015 and 2024 can begin by monitoring their email and financial accounts for unusual activity and by placing fraud alerts with credit-reporting agencies where available. Because the exact population exposed is not publicly known, running a free exposure scan of one’s email address against known breach repositories provides an initial check for any appearance in published data sets. Organisations holding similar identity records are advised to review retention schedules and access controls for passport imagery.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Primed Halberstadt Medizintechnik Listed by aurora Ransomware GroupCorporación Primax S.A. Listed by aurora Ransomware GroupAerospace & Advanced Composites GmbH Listed by aurora Ransomware GroupNTP B.V. Civil Engineering Construction Listed by aurora Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Cheval Blanc Randheli Listed by aurora Ransomware Group →
Publicly posted by aurora — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.