Comohotels.com Listed by redransomware Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target hospitality brands that hold guest records, staff details and operational data, listing victims on leak sites to pressure payment. Against that backdrop, Comohotels.com appeared on a redransomware listing dated 5 March 2024. Public detail remains limited: the number of people affected is unknown, and the only data category named is internal files said to have been exfiltrated. The listing itself is an unverified claim by the group; no independent confirmation of the intrusion or the volume of material has been published.

For guests, employees and partners of a luxury hotel group, even an unconfirmed claim of internal-file theft raises practical questions about what may have left the organisation and how that information could be misused. The following account stays strictly within the reported facts and established public knowledge of the actor and sector.

Inside the incident

On 5 March 2024, the ransomware group redransomware listed Comohotels.com among its claimed victims. The sole description of the material involved is “internal files exfiltrated in ransomware attack.” No figure for the number of people affected has been released, no specific file names or volumes have been disclosed, and no technical details of the intrusion method have been made public. The organisation has not issued a detailed public statement confirming or denying the claim in the material available for this report. In short, the incident is known only through the group’s leak-site listing and the sparse accompanying description.

Who is redransomware?

Redransomware is a ransomware operation that follows the now-common double-extortion model: encrypt systems and simultaneously copy data, then threaten to publish the stolen material if a ransom is not paid. Like other groups of its type, it maintains a dark-web leak site where it posts victim names, sometimes accompanied by sample files or countdown timers. Public reporting on the group has documented its use of phishing, exploitation of remote-access services and living-off-the-land techniques to gain initial footholds, followed by lateral movement and data staging before encryption. Specific claims made about any individual victim, including Comohotels.com, remain assertions by the group until independently verified. No further statements attributed to redransomware about this particular organisation appear in the available facts.

Who is Comohotels.com?

Comohotels.com is the online presence of a multi-award-winning, family-owned group of luxury hotels and resorts located at destinations worldwide. The brand emphasises properties that “honour the spirit of place.” Organisations of this kind typically process guest reservations, payment-card data, loyalty-programme details, employee records, supplier contracts and internal operational documents. Because luxury hospitality relies on personalised service and high-value clientele, the data held can include sensitive personal and financial information. A successful ransomware incident against such a group therefore carries consequences both for the brand’s reputation and for the individuals whose records may have been involved.

What was likely exposed

The only data type named in the available facts is “internal files exfiltrated in ransomware attack.” No inventory of those files has been published, and the exact contents remain unconfirmed. Luxury hotel groups commonly store guest contact details, booking histories, payment information, staff personal data, contracts and internal correspondence. Whether any of those categories were among the files claimed by redransomware cannot be established from the public record. Readers should treat any assertion of specific data types beyond the stated “internal files” as unverified.

What's at stake

If internal files were indeed taken, the practical risks include identity fraud, phishing campaigns that exploit knowledge of past stays or corporate relationships, and potential exposure of employee or supplier information. For the organisation, the consequences can include regulatory notification obligations, reputational damage among high-net-worth guests, and the operational cost of forensic investigation and system recovery. Because the scale of the alleged exfiltration is unknown, the precise number of individuals who may need to take protective steps cannot be stated. The absence of confirmed detail does not eliminate the need for caution; it simply means responses must be based on prudent general practice rather than a definitive list of compromised records.

If your data was in this claimed breach

Anyone who has stayed at, worked for or done business with Comohotels.com properties should treat the possibility of exposure seriously until more information emerges. Practical first steps include monitoring bank and credit-card statements for unfamiliar charges, enabling multi-factor authentication on email and loyalty accounts, and being alert to phishing messages that reference hotel stays or personal details. Changing passwords for any accounts that reuse credentials associated with the brand is advisable. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. If unusual activity is detected, contact the relevant financial institution promptly and consider placing a fraud alert with credit-reporting agencies. Continued monitoring of official statements from the hotel group remains the best source of updates specific to this incident.

AICompiled with AI assistance from public sources and published under our editorial standards.