Hornavan Hotell Listed by Deadlock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 15, 2026, the ransomware group Deadlock listed Hornavan Hotell on its public leak site and stated that internal files had been taken during a ransomware operation. The number of people whose information may be involved is not known, and no further details about the volume or specific categories of data have been released by either the group or the hotel. The listing itself constitutes the primary public record of the incident. No confirmation of the data’s authenticity or scope has been issued by Hornavan Hotell, and the exact date of the intrusion remains undisclosed.

Inside the incident

The available information is limited to Deadlock’s claim that files were removed from Hornavan Hotell’s systems. No ransom demand amount, encryption status, or timeline of events has been made public. The scale of the operation, including whether any data was subsequently published, is also unconfirmed at this stage.

Inside Deadlock

Deadlock is a ransomware operator that follows the common pattern of exfiltrating data before encrypting systems and then posting victim names on a dedicated leak site. The group’s listings serve as a form of public pressure, with the implicit threat that further material may be released if negotiations fail. Similar actors have targeted organisations across multiple sectors in recent years, though each incident must be assessed on its own disclosed facts.

Who is Hornavan Hotell?

Hornavan Hotell operates as an independent three-star property located in Arjeplog, in Swedish Lapland. Like other small hospitality businesses, it maintains records related to reservations, guest stays, and internal operations. A breach at such a site can affect both visitors and staff whose information is stored in booking or administrative systems.

What data was at risk

The only detail provided is that internal files were allegedly exfiltrated. The precise contents of those files have not been disclosed. Hotels of this type routinely process names, addresses, booking dates, contact information, and sometimes payment or identification documents; however, it is not confirmed whether any of these categories were among the material taken in this case.

Why it matters

Even without Reported Details, the exposure of internal files can create downstream risks for individuals whose personal information appears in reservation or administrative records. For the organisation, the incident adds operational and reputational consequences at a time when many smaller hospitality businesses already manage limited security resources. The absence of public confirmation leaves affected people without clear guidance on the exact nature of any exposure.

Were you affected?

Individuals who have stayed at Hornavan Hotell or conducted business with the property can begin by monitoring their email and financial accounts for unusual activity. Contacting the hotel directly may yield additional information once the organisation completes its own review. Readers can also run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in previously published incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.