Hotel Avenida, Hostal Espoz y Mina, Hostal Arriazu, Pension Alemana Listed by trigona Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who stayed at or worked with Hotel Avenida, Hostal Espoz y Mina, Hostal Arriazu or Pension Alemana may have personal or booking-related information caught up in a claimed ransomware incident. Public reporting places the listing on 28 February 2024; the number of people affected remains unknown, and the precise contents of any taken files have not been confirmed beyond the statement that internal files were allegedly exfiltrated.

For guests and staff the practical stakes are straightforward: hospitality businesses routinely hold reservation details, contact information and payment-related records. When a ransomware group claims to have removed internal files, those individuals face the ordinary risks of unwanted contact, credential stuffing or identity misuse until more is known.

What happened

On 28 February 2024 the ransomware group known as Trigona listed Hotel Avenida, Hostal Espoz y Mina, Hostal Arriazu and Pension Alemana on its leak site. The listing asserts that internal files were exfiltrated during a ransomware attack. No public confirmation of the intrusion method, the exact date of any compromise, the volume of data taken or the number of individuals affected has been released. The organisations themselves have not issued a detailed public statement that expands on the claim. In short, the only concrete public detail is the group’s assertion that internal files were removed and that the properties appear on its site.

The group behind it: trigona

Trigona is a ransomware operation that has been active in recent years and is known for double-extortion tactics: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. Like many such groups, it maintains a dark-web leak site where it posts victim names and, sometimes, sample files to pressure organisations. Public reporting has linked Trigona to attacks across multiple sectors and countries; the group typically demands payment in cryptocurrency and sets deadlines before releasing material. In this case the only claim specific to these properties is the listing itself; no further statements from Trigona about the content or size of any haul have been made public.

Who is Hotel Avenida, Hostal Espoz y Mina, Hostal Arriazu, Pension Alemana?

These properties form part of a boutique hospitality collection that markets itself as offering distinctive stays in Lisbon and the historic centre of Pamplona. Hotels and hostels of this type typically manage guest reservations, identity documents required for check-in, contact details, payment card information processed at booking or arrival, and internal operational records such as staff schedules and supplier contracts. Because travellers often supply the same personal data repeatedly across bookings, a compromise at even a small collection of properties can affect people who stayed only once as well as frequent guests and employees. The sector’s reliance on shared booking platforms and on-site systems makes such organisations attractive targets for ransomware operators seeking both operational disruption and data that can be leveraged for extortion.

What data was at risk

The public facts state only that “internal files” were exfiltrated in a ransomware attack. No inventory of specific data types—guest lists, payment records, staff files or otherwise—has been disclosed. Organisations in this sector commonly hold reservation databases, guest contact and identification details, payment-card data (often tokenised or processed through third parties), loyalty or membership information, and internal administrative documents. Because the exact contents remain unconfirmed, it is not possible to state with certainty which of these categories, if any, were taken. Readers should treat the exposure as potential rather than proven until further official detail appears.

The real-world impact

For individuals the main risks are secondary misuse of any personal data that may have been copied: phishing emails that reference a real stay, attempts to reset accounts using known email addresses, or fraudulent bookings made in a guest’s name. Staff could face similar exposure of payroll or identity information. For the properties themselves the consequences include operational disruption during any encryption event, potential regulatory notification duties under data-protection rules, reputational damage among travellers, and the cost of forensic investigation and system recovery. Because the number of people affected is unknown and the data types are not itemised, the scale of these effects cannot yet be quantified; the prudent assumption is that anyone who has recently stayed at or worked for the listed properties should monitor for unusual activity.

What to do if you're exposed

If you have reason to believe your information may have been involved, take the following practical steps:

• Change passwords for any accounts that used the same email address or phone number you supplied to the properties, and enable multi-factor authentication where available.
• Monitor bank and credit-card statements for unauthorised charges and consider a temporary fraud alert with your card issuer.
• Be sceptical of unsolicited emails or calls that reference a recent stay; verify any claim directly through official hotel channels rather than links in the message.
• Request a free exposure scan of your email address against known breach data sets so you can see whether that address has already appeared in other public leaks.

These measures do not reverse any exfiltration, but they reduce the chance that stolen details can be used against you. Continue to watch for official statements from the properties or relevant authorities for any further confirmed detail.

AICompiled with AI assistance from public sources and published under our editorial standards.