InTown Suites Listed by snatch Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The InTown Suites Listed by snatch Ransomware Group (reported December 21, 2021) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
On December 21, 2021, the ransomware group Snatch listed InTown Suites on its leak site, claiming to have exfiltrated internal files during a ransomware operation. Public records confirm only the listing itself and the general description of stolen material; the number of individuals affected, the precise volume of data, and any subsequent actions by the company remain undisclosed.
Such listings form part of a broader pattern in which ransomware operators combine encryption with data theft to pressure victims. The incident at InTown Suites illustrates how extended-stay hospitality providers, which routinely process guest records and operational systems, can become targets in this environment.
Inside the incident
The only confirmed public information is the December 21, 2021 listing by Snatch and the statement that internal files were taken. No official count of records, timeline of intrusion, or confirmation of encryption has been released by InTown Suites or independent investigators. Details on whether the data was published, sold, or used for further activity are not available in public reporting.
The group behind it: snatch
Snatch is a ransomware operation that has maintained a public leak site since at least 2019. The group typically advertises stolen data from listed organizations and has been linked in open-source reporting to double-extortion tactics, in which files are copied before encryption. Its listings appear without independent verification of the underlying claims; victims sometimes dispute the extent or even the occurrence of any breach.
About InTown Suites
InTown Suites operates more than 196 locations across 22 states as a wholly owned economy extended-stay brand. Properties of this type collect and retain guest identification, payment details, reservation histories, and internal operational records to manage long-term stays. A compromise at such a scale therefore touches both customer information and business systems that support daily lodging services.
What data was at risk
The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types, record counts, or data categories has been published. Organizations in the extended-stay sector commonly hold guest names, addresses, payment card data, loyalty information, and employee records, yet the exact contents in this case remain unconfirmed.
The real-world impact
Individuals whose information appears in stolen internal files may face risks of identity fraud or targeted phishing if the material later circulates. For the company, the incident adds to the operational burden of investigating the intrusion, notifying regulators where required, and restoring systems. No public statements quantify financial loss or regulatory exposure at this time.
What to do if you're exposed
Monitor bank and credit-card statements for unauthorized activity and place fraud alerts with major credit bureaus if personal identifiers were involved. Use unique passwords and enable multi-factor authentication on any accounts tied to the hotel.
- Review statements from December 2021 onward for suspicious charges.
- Request a free credit report from each of the three major bureaus.
- Run a free exposure scan of your email address against known breach data.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
The Execu|Search Group Listed by snatch Ransomware GroupQRS Healthcare Solutions Listed by snatch Ransomware GroupBock, Hatch, Lewis & Oppenheim, LLC Listed by snatch Ransomware GroupArbitech Listed by snatch Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the InTown Suites Listed by snatch Ransomware Group →
Publicly posted by snatch — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.