Dithelm Travel Group Listed by global Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 26, 2025, Dithelm Travel Group, a destination management company operating in Asia, was listed by the ransomware group known as global. Public reporting indicates that internal files were exfiltrated as part of a ransomware attack. The number of people affected remains unknown, and further details about the incident have not been disclosed.

This listing places the travel agency, formerly known as Diethelm Travel and now operating as DTH Travel, among organisations claimed as victims by ransomware operators. For clients, partners and staff connected to the company, the development raises questions about the security of internal records even while What's Publicly Reported stay limited.

Breaking down the breach

The available public information states that Dithelm Travel Group was listed by the global ransomware group on July 26, 2025. The report characterises the incident as a ransomware attack in which internal files were allegedly exfiltrated. No figures have been released for the volume of data taken, the number of systems involved, or the precise method of initial access. The scale of any encryption, the presence or absence of a ransom demand, and any subsequent recovery steps remain undisclosed. Attribution rests on the group’s own leak-site listing, which constitutes a claim rather than independently verified confirmation.

The group behind it: global

Global is a ransomware operation that follows the double-extortion model common among contemporary groups: data is stolen before systems are encrypted, and the threat of public release is used to pressure victims. Such groups typically maintain dedicated leak sites where they post victim names and, in some cases, sample files to demonstrate possession of the material. They often target mid-sized organisations across multiple sectors, relying on phishing, compromised credentials or unpatched remote-access services for entry. Once inside, they move laterally, identify valuable repositories and exfiltrate data prior to deploying encryption. Public records of earlier campaigns show that global, like peer groups, has claimed responsibility for attacks on companies in travel, logistics and professional services. In the present case the group claims Dithelm Travel Group as a victim; no additional statements from the group about this specific organisation have been reported beyond the listing itself.

Who is Dithelm Travel Group?

Dithelm Travel Group, previously known as Diethelm Travel and currently trading as DTH Travel, is a destination management company headquartered in Asia with offices across the continent. It specialises in tailor-made, responsible and authentic travel experiences, offering holiday packages, excursions, meetings, incentives, conferences and events (MICE) and related services. The company emphasises a boutique, locally grounded approach. Destination management companies of this type routinely handle itineraries, booking records, client contact details, supplier contracts and payment information for leisure and corporate travellers. A breach at such an organisation can therefore touch both individual travellers and business partners who rely on the firm for ground arrangements throughout Asia.

What data was at risk

Public reporting states only that internal files were exfiltrated. No inventory of the specific data types, file counts or categories has been released. Organisations in the destination-management sector typically store customer names, contact details, passport or identification numbers required for bookings, travel dates, payment card or invoice data, and internal correspondence with hotels, transport providers and other suppliers. Whether any of these categories were among the files taken in this incident remains unconfirmed. The exact contents of the exfiltrated material are therefore unknown.

Why it matters

For individuals whose details may have been held by Dithelm Travel Group, the principal risks include potential misuse of personal and travel-related information for phishing, identity fraud or unsolicited contact. Even limited internal files can contain enough context to craft convincing social-engineering attempts. For the organisation itself, the incident can disrupt operations, damage relationships with clients and suppliers, and trigger regulatory notification duties depending on the jurisdictions involved. Because the number of people affected and the precise data categories remain undisclosed, the full scope of exposure cannot yet be quantified. The listing alone, however, signals that sensitive material may now be in the hands of a criminal group known for public data dumps when ransoms are unpaid.

What to do if you're exposed

Anyone who has booked travel or conducted business with Dithelm Travel Group or DTH Travel should monitor financial statements and credit reports for unusual activity and treat unexpected emails or calls that reference past trips with caution. Change passwords on any accounts that may have shared credentials with travel-related services, and enable multi-factor authentication where available. If you receive notification from the company, follow its guidance on next steps. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Remaining alert to secondary scams that exploit news of the incident is advisable until more definitive information emerges.

AICompiled with AI assistance from public sources and published under our editorial standards.