Curtain Bluff Listed by medusalocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Curtain Bluff, the Antigua resort operator behind curtainbluff.com, was listed on March 25, 2025 by the ransomware group medusalocker as a victim of a data-exfiltration attack. Public reporting so far consists of the group’s own leak-site claim that internal files were taken; the number of people affected remains unknown and no independent confirmation of the intrusion has been published.

The listing matters because the files the group claims to hold include guest personal data, financial records and internal credentials. Until more verified detail emerges, anyone who has stayed at or done business with the resort has reason to treat the claim as a credible risk signal rather than proven fact.

Breaking down the breach

According to the medusalocker listing dated March 25, 2025, the group asserts that it exfiltrated internal files from Curtain Bluff in a ransomware attack. The only concrete description available is the group’s own summary: vacationer information containing personal data, multi-year audit records, bank statements showing all transactions, internal organisational documents (including menus), other unspecified files, and roughly 500 unique login/password pairs. The group set a ransom demand of $120,000. No public source has confirmed the date of the intrusion, the method of initial access, the total volume of data, or whether any systems remain encrypted. The number of individuals whose information may be involved is listed as unknown.

The group behind it: medusalocker

Medusalocker is a well-documented ransomware operation that has been active for several years. Like many modern ransomware crews, it typically combines data theft with encryption, then pressures victims by threatening to publish the stolen material on a dedicated leak site if payment is not made. The group has previously listed organisations across hospitality, professional services and other sectors, often posting sample files and ransom figures to demonstrate possession of the data. In this case the listing of Curtain Bluff and the accompanying description of files and the $120,000 price are claims made by the group itself; they have not been independently verified by the resort or by law-enforcement statements released to date.

Curtain Bluff and its sector

Curtain Bluff is a luxury beach resort on the island of Antigua that markets itself to vacationers seeking all-inclusive stays. Hospitality businesses of this type routinely collect and retain guest reservation details, payment-card or bank information, passport or identification data for immigration compliance, staff records, supplier contracts and internal operational documents. Because the sector handles both high-value financial transactions and sensitive personal identifiers, a successful ransomware intrusion can expose guests, employees and business partners simultaneously. The potential release of such material raises practical concerns about identity misuse, financial fraud and reputational harm for the organisation.

The information in question

The medusalocker listing states that the stolen material comprises vacationer personal data, audit information spanning past years, bank activity including full transaction statements, internal documentation (explicitly mentioning menus), other documents, and approximately 500 unique login/password pairs. These categories are presented solely as the group’s claim; no third-party inventory or forensic report has been made public to confirm the exact contents or completeness of the haul. Organisations in the resort sector typically hold precisely these kinds of records—guest profiles, financial ledgers and credential stores—so the claimed set is consistent with what such a business would possess, yet the precise files remain unconfirmed beyond the leak-site description.

The real-world impact

If the claimed data are authentic and are released or sold, guests could face risks of identity theft, targeted phishing or fraudulent charges based on the bank statements and personal details. Staff or contractors whose credentials appear among the roughly 500 login pairs may see those accounts abused for further intrusion or social-engineering attacks. For Curtain Bluff itself the exposure of multi-year audit and banking records could complicate regulatory obligations, insurance claims and guest trust. Because the number of affected people is unknown and no official notification timeline has been published, individuals who have interacted with the resort cannot yet determine with certainty whether their own information is involved.

What to do if you're exposed

Anyone who has stayed at, worked for or transacted with Curtain Bluff should treat the listing as a prompt for basic protective steps rather than confirmed personal compromise. Practical first actions include:

• Monitor bank and credit-card statements for unfamiliar transactions and enable transaction alerts where available.
• Change any passwords that may have been reused on Curtain Bluff-related accounts and enable multi-factor authentication on email and financial services.
• Watch for phishing messages that reference a recent stay or payment and avoid clicking unsolicited links.
• Consider placing a fraud alert or credit freeze with major credit bureaus if personal identifiers such as passport or address data were supplied to the resort.
• Run a free exposure scan of your email address against known breach datasets to check whether the address has already appeared in public leak collections.

Official confirmation or further detail from Curtain Bluff or investigators may still emerge; until then these measures reduce the most common follow-on risks associated with the types of data the group claims to hold.

AICompiled with AI assistance from public sources and published under our editorial standards.