krasnoyarsk.amaks Listed by werewolves Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out hospitality and regional hotel operators, treating guest systems and internal networks as high-value targets for double-extortion campaigns. In this climate, even mid-sized properties that form part of larger chains can find themselves publicly listed on leak sites, with claims of large data volumes held for release.

On 14 September 2023, the organisation identified as krasnoyarsk.amaks appeared on a listing attributed to the werewolves ransomware group. Public detail is limited: the number of people affected remains unknown, and the material described is characterised only as internal files exfiltrated in a ransomware attack. The listing itself is an unverified claim by the group.

What happened

According to the reported listing, krasnoyarsk.amaks was named by the werewolves ransomware group on 14 September 2023. The group’s own summary identifies the victim as «АМАКС Сити-отель», described as a modern fifteen-storey business complex belonging to the AMAKS Hotels & Resorts network. The listing asserts that the hotel has information-security problems, that client data is not adequately protected despite a centralised antivirus management policy on hosts, and that more than one terabyte of data will be published on Tor mirrors for anyone to access. No independent confirmation of the intrusion method, the precise date of compromise, or the actual publication of the claimed volume has been supplied in the available record. The scale of individuals affected is undisclosed.

Inside werewolves

Werewolves is a ransomware operation that has appeared in public reporting as a group practising double extortion: encrypting systems while also exfiltrating data and threatening to leak it if demands are not met. Like other actors in this category, it typically advertises victims on dedicated leak sites, often accompanied by brief descriptions of the organisation and claims about the volume or nature of stolen files. Tactics commonly associated with such groups include initial access through exposed services or compromised credentials, lateral movement, and the staged theft of internal documents before ransomware deployment. Specific statements the group has made about this particular victim are limited to the content of the listing itself; those statements should be treated as claims rather than established fact.

krasnoyarsk.amaks and its sector

krasnoyarsk.amaks corresponds to the AMAKS City Hotel in Krasnoyarsk, a property within the AMAKS Hotels & Resorts chain. Hotels of this type routinely manage reservations, guest profiles, payment-related records, staff information, and operational documents. The hospitality sector has repeatedly drawn ransomware attention because properties hold both personal data of travellers and the internal files needed to keep a multi-storey business hotel running. A breach affecting such an organisation matters because guests, corporate clients, and employees may have little visibility into what was taken, while the hotel itself faces operational disruption, regulatory scrutiny, and reputational harm. Public detail does not establish how the alleged incident occurred or whether any particular control failed.

What was likely exposed

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. The group’s listing further claims that more than one terabyte of data, including inadequately protected client data, is slated for release. Exact contents are unconfirmed. Organisations in the hotel sector typically hold guest contact details, booking histories, identity or loyalty information, payment-related data, employee records, and internal business documents. None of these categories can be stated as confirmed contents of this incident; the precise inventory remains undisclosed beyond the general description of internal files and the group’s unverified assertions.

The real-world impact

For individuals whose information may have been among the exfiltrated files, risks include unwanted contact, phishing that references genuine stay or booking details, and potential misuse of personal or payment-related data if such records were present. Because the number of people affected is unknown and the exact data types are not independently verified, the concrete exposure for any single person cannot be quantified from public information alone. For the organisation, a ransomware incident of this kind can mean temporary disruption to reservations and operations, costs associated with investigation and recovery, and the longer-term task of notifying affected parties and regulators where required. The claim of a forthcoming multi-terabyte dump on Tor, if realised, would increase the chance that internal material circulates beyond the initial attackers.

If your data was in this claimed breach

If you have stayed at or done business with the property, treat any unexpected messages that reference a recent booking or personal details with caution. Monitor financial statements for unfamiliar charges, consider updating passwords on accounts that may have reused hotel-related credentials, and enable multi-factor authentication where available. You may also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. Official guidance from the hotel or relevant authorities, if issued, should take precedence over unverified claims circulating online.

AICompiled with AI assistance from public sources and published under our editorial standards.