guesty, LITELLM/TRIVY CAMPAIGN (TEAMPCP) Listed by vect Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 15, 2026, the ransomware group vect listed Guesty on its leak site, claiming to have obtained internal files from the company during a ransomware incident. The entry states a negotiating status and references a claimed data volume of 700 GB, though independent confirmation of the exfiltration or its contents remains unavailable at this time. The listing appears within a campaign the group has labeled LITELLM/TRIVY. Public details on the number of individuals potentially affected have not been disclosed.

What happened

The incident came to light through vect’s leak-site posting on April 15, 2026. The entry describes the theft of internal files during a ransomware attack and places the matter in a negotiating phase with a stated deadline of nine days and eight hours from the posting. No separate statement from Guesty confirming or disputing the claims has been referenced in the available record. The scale of any operational disruption or the precise method of initial access is not detailed in the listing.

Who is vect?

Vect is a ransomware group that maintains a public leak site to pressure victims. Like other actors in this category, it typically claims to encrypt systems and exfiltrate data, then threatens publication unless ransom demands are met. The group’s listings are presented as its own assertions; independent verification of the underlying incidents is not provided by the group itself.

Who is Guesty?

Guesty operates in the property-management sector, providing software platforms that connect property owners and managers with short-term rental marketplaces. Organizations of this type routinely process reservation details, guest communications, and integrations with services such as Airbnb and Booking.com. A compromise at such a firm can therefore involve both operational records and large volumes of customer-related correspondence.

The information in question

The vect listing claims the exfiltrated material includes internal projects, approximately four million sent and received emails with attachments, userbase records, and data tied to Airbnb and Booking.com integrations, for a stated total of 700 GB. The precise categories of personal or sensitive information contained within those files have not been independently confirmed. Organizations in this sector commonly hold booking histories, contact details, and payment-related correspondence, but the exact contents of the claimed dataset remain unverified beyond the group’s description.

The real-world impact

Individuals whose information appears in the claimed dataset could face increased risk of targeted phishing or misuse of booking and contact details. For the organization, the exposure of internal projects and extensive email archives may complicate ongoing operations and require extended remediation. Because the number of affected individuals is not publicly stated, the full scope of downstream consequences cannot yet be quantified.

Were you affected?

Begin by monitoring official communications from Guesty for any notifications it may issue. Review your email accounts for any unexpected activity and consider changing passwords for services linked to the platform. Running a free exposure scan of your email address against known breach repositories can indicate whether your information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.