ihg.com Listed by lockbit2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

ihg.com was listed on the leak site operated by the lockbit2 ransomware group on March 17, 2022. The listing states that internal files were taken during a ransomware attack, though the number of people affected and the precise contents of the data remain undisclosed.

The incident is one of many claims made by ransomware operators against corporate targets. Without independent confirmation of the data’s scope or subsequent use, the practical consequences for individuals are not yet known.

What happened

On March 17, 2022, ihg.com appeared on the lockbit2 ransomware group’s data-leak site. The entry asserts that internal files were exfiltrated during a ransomware operation. No further details about the timing of the intrusion, the volume of data, or the attack method have been released by the organization or by investigators.

The number of individuals whose information may be involved is not stated. The only confirmed element is the public listing itself and the group’s claim that files were removed.

Who is lockbit2?

LockBit is a ransomware-as-a-service operation that first appeared in late 2019 and released an updated version, LockBit 2.0, in 2021. The group typically deploys encryption on victim systems and then threatens to publish stolen files unless a ransom is paid. It maintains a public leak site where it lists organizations it claims to have targeted.

The group has been linked to intrusions across multiple industries. Its listings represent assertions made by the operators; independent verification of each claim is not always available.

About ihg.com

ihg.com is the consumer-facing site for InterContinental Hotels Group, a large hospitality company that operates hotel brands worldwide. Organizations in this sector routinely process reservations, loyalty-program records, and contact information for guests and corporate clients.

Because these companies maintain systems that connect customer data with payment and identity details, any confirmed exposure of internal files can raise questions about the security of personal and financial records held by the business.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types or data categories has been published. The exact contents therefore remain unconfirmed.

Companies of this kind commonly store names, addresses, email addresses, phone numbers, booking histories, and loyalty-program identifiers. Whether any of those categories were among the claimed files cannot be determined from the available information.

Why it matters

Internal files can contain operational documents, employee records, or customer data that, if later published or sold, may be used for targeted phishing or identity-related fraud. The absence of a confirmed record count makes it impossible to gauge the scale of any such risk at present.

For the organization, the listing adds to the body of public claims that can affect customer trust and may prompt regulatory scrutiny, even when the underlying facts are still limited.

If your data was in this claimed breach

Monitor email accounts and loyalty-program profiles for unexpected activity. Enable multi-factor authentication on any associated services and review recent statements for signs of unauthorized use.

Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in previously published records from other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.