Món Sant Benet Listed by datacarry Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target cultural and tourism operators across Europe, treating them as sources of operational data and potential leverage rather than purely financial institutions. In this environment, listings on criminal leak sites have become a routine signal that an organisation may have suffered an intrusion, even when independent confirmation remains limited.

On 7 June 2025, the ransomware group datacarry publicly listed Món Sant Benet, a Catalan cultural and leisure complex. The group claims it exfiltrated internal files during a ransomware attack. The number of people affected is unknown, and further technical detail has not been disclosed. The listing itself is an unverified claim, yet it places the organisation and anyone whose information may have been held in its systems under scrutiny.

Breaking down the breach

Public reporting states only that Món Sant Benet was listed by datacarry on 7 June 2025 and that the group claims internal files were exfiltrated in a ransomware attack. No confirmed date of initial access, no volume of data, no specific file names or systems, and no independent verification of the intrusion have been released. The number of individuals potentially affected remains unknown. In the absence of further disclosure, the incident rests on the group’s leak-site claim rather than on forensic confirmation from the organisation or authorities.

The group behind it: datacarry

Datacarry is a ransomware operation that follows the now-standard double-extortion model: encrypting systems while simultaneously stealing data and threatening to publish it if payment is not made. Like many such groups, it maintains a public leak site on which it lists victims and, in some cases, samples of stolen material. The group’s listings are claims intended to pressure organisations; they do not constitute independent proof that every asserted detail is accurate. No statements attributed to datacarry beyond the listing of Món Sant Benet and the assertion of internal-file exfiltration are available for this incident.

Who is Món Sant Benet?

Món Sant Benet is a cultural, tourist and leisure complex in Catalonia, Spain. It combines a medieval monastery dating to the 10th century, the modernist summer residence of painter Ramón Casas, the Alícia Foundation dedicated to gastronomic research, and a luxury four-star hotel. The site offers guided tours, events, gastronomic experiences and educational workshops. Organisations of this type typically hold visitor and guest records, staff information, booking and payment data, supplier contracts, and internal operational documents. A breach at such a venue can therefore touch both the public who visit or stay there and the people who work for or with the complex.

The information in question

The only data type named in connection with the listing is “internal files” said to have been exfiltrated. Exact contents have not been disclosed. Cultural and hospitality operators commonly store reservation details, contact information for guests and event participants, employee records, financial and supplier files, and planning documents. Whether any of those categories were among the files claimed by datacarry remains unconfirmed. Until more precise information is released, the scope of exposure cannot be stated as fact.

What's at stake

For individuals, the practical risks centre on the possible misuse of personal or contact data if it was present among the internal files: unwanted contact, phishing attempts that reference real bookings or visits, or identity-related fraud if identifiers were included. For the organisation, the stakes include operational disruption from any encryption that may have occurred, reputational damage from the public listing, potential regulatory scrutiny under data-protection rules, and the cost of investigation and remediation. Because the number of people affected and the precise data types remain unknown, the full extent of these risks cannot yet be measured.

What to do if you're exposed

Anyone who has visited, stayed at, worked for or done business with Món Sant Benet should treat the listing as a prompt for basic precautions rather than as confirmed proof of personal compromise. Practical first steps include:

• Monitor bank and card statements for unexpected charges and enable transaction alerts where available.
• Be sceptical of unsolicited emails, calls or messages that reference a stay, event or booking at the complex; verify any request through official channels.
• Change passwords for accounts that may have been used in connection with the site, and enable multi-factor authentication where offered.
• Review credit or identity-monitoring services if you believe sensitive identifiers could have been involved.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in public or criminal collections.

Public detail on this incident remains limited. Further official statements from Món Sant Benet or Spanish authorities would be required to clarify scale, content and confirmation of the claimed exfiltration.

AICompiled with AI assistance from public sources and published under our editorial standards.