Costa Del Sol Hotels Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Costa Del Sol Hotels, a Kuwaiti hospitality operator, was listed by the sarcoma ransomware group on or around 9 October 2024. Public reporting indicates the group claims to have exfiltrated internal files in a ransomware attack, with an archive sized at 50.5 GB. The number of people affected remains unknown, and further technical details of the intrusion have not been disclosed.

The listing matters because hospitality businesses routinely handle guest reservations, payment details, staff records and operational documents. Even when exact contents are unconfirmed, any confirmed or claimed exfiltration of internal files raises concrete risks of fraud, identity misuse and operational disruption for those connected to the organisation.

Inside the incident

According to available records, Costa Del Sol Hotels appeared on the sarcoma leak site with a reported date of 9 October 2024. The group claims the material consists of internal files obtained through a ransomware attack and packaged as a 50.5 GB archive. No public confirmation of the intrusion method, initial access vector, encryption status of systems, or precise timeline of the attack has been released. The number of individuals whose data may be involved is listed as unknown. Costa Del Sol Group is described in the listing as a Kuwaiti hospitality entity that has operated since the 1980s and manages two hotels plus a rural estate; the listing itself remains an unverified claim by the threat actor pending independent corroboration.

The group behind it: sarcoma

Sarcoma is a ransomware operation that follows the now-common double-extortion model: operators encrypt victim systems while also stealing data and threatening to publish it on a dedicated leak site if a ransom is not paid. Public reporting on the group shows it typically advertises victims with brief descriptions, claimed data volumes and sample file listings, then releases archives if negotiations fail. Sarcoma has previously listed organisations across multiple sectors and geographies; its listings are claims of compromise rather than independently Reported Facts. In this case the group asserts it holds 50.5 GB of files from Costa Del Sol Hotels; no further statements attributed specifically to this victim beyond the listing details have been made public.

Who is Costa Del Sol Hotels?

Costa Del Sol Hotels operates under the Costa Del Sol Group, a Kuwaiti hospitality business active since the 1980s. It manages two premier hotels and a rural estate, serving guests who book stays, use on-site services and interact with staff. Organisations of this type typically maintain reservation systems, guest profiles, payment-card processing records, employee personnel files, supplier contracts and internal operational documents. A breach affecting such an entity is consequential because the data can include personal identifiers, contact details, travel itineraries and financial information belonging to guests and staff, as well as commercially sensitive material that could affect business continuity or reputation if exposed.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack and that the claimed archive is 50.5 GB containing files. Exact data types beyond that description have not been disclosed. Hospitality operators commonly hold guest names, contact information, booking histories, payment details, loyalty-programme data, staff employment records, and internal correspondence or contracts. Because the precise contents remain unconfirmed, it is not possible to state which of these categories, if any, are present in the claimed archive. Readers should treat any specific file lists circulating online as unverified until corroborated by the organisation or independent analysis.

What's at stake

For individuals, the principal risks are identity theft, phishing or social-engineering attempts that reference real booking or employment details, and potential financial fraud if payment or identity documents were among the files. Guests and staff whose information appears in the archive may face repeated contact from scammers who exploit the legitimacy of the stolen data. For the organisation, consequences can include regulatory scrutiny under applicable data-protection rules, costs of incident response and notification, possible service interruptions, and erosion of guest trust. Because the scale of affected individuals is unknown and the exact data types unconfirmed, the full extent of these risks cannot yet be quantified.

Were you affected?

If you have stayed at, worked for, or otherwise shared personal information with Costa Del Sol Hotels or the Costa Del Sol Group, treat the listing as a prompt to take basic protective steps. Exact confirmation of individual exposure is not publicly available, so practical measures remain the safest course.

• Monitor bank and credit-card statements for unfamiliar charges and enable transaction alerts where offered.
• Change passwords for any accounts that reuse credentials potentially linked to hotel bookings or staff portals, and enable multi-factor authentication.
• Be alert to phishing emails or messages that reference recent stays, invoices or employment details; verify any request through official channels before responding.
• Consider placing a fraud alert or credit freeze with relevant credit bureaux if you believe sensitive identity documents may have been involved.
• Run a free exposure scan of your email address against known breach datasets to check whether your information has already appeared in public dumps.

Public detail on this incident remains limited to the sarcoma listing and the stated 50.5 GB archive of internal files. Further official statements from Costa Del Sol Hotels, if issued, should be treated as the primary source for updates.

AICompiled with AI assistance from public sources and published under our editorial standards.