RADISSONHOTELSAMERICAS.COM Listed by clop Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 10, 2023, RADISSONHOTELSAMERICAS.COM appeared on a ransomware leak site operated by the group known as clop. The listing asserts that internal files were taken in a ransomware attack. For guests, employees, partners, and others whose information might sit in hotel systems, the practical concern is straightforward: whether personal or business data has left the organisation’s control and could be misused.

Public detail remains limited. The number of people affected is unknown, and the precise contents of any stolen material have not been independently confirmed. What is known is the claim itself and the sector in which the organisation operates—hospitality—where reservations, identity details, and payment-related records are routinely handled.

Breaking down the breach

According to available reporting, RADISSONHOTELSAMERICAS.COM was listed on the clop ransomware leak site on or about July 10, 2023. The group claims to have stolen internal data through a ransomware attack that involved exfiltration of internal files. No verified figure has been published for the volume of data, the number of affected individuals, or the exact date the intrusion began or was discovered. Method of initial access, duration of presence in the environment, and any ransom demand or negotiation are undisclosed in the public record surrounding this listing.

Listings on ransomware leak sites are assertions by the threat actors. They are not the same as a confirmed forensic disclosure by the victim organisation. In this case, the facts establish only that the domain was named and that clop stated internal files had been taken. Independent confirmation of the full scope has not been provided in the material available for this account.

Who is clop?

Clop is a ransomware group that has operated for several years and is widely documented in public cybersecurity reporting. The group is known for double-extortion tactics: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. Clop has frequently used leak sites to name victims and, in some campaigns, to release samples or larger sets of stolen files.

The group has been associated with opportunistic and large-scale operations, including exploitation of vulnerabilities in widely used file-transfer and enterprise software. Its public postings typically frame the victim’s data as already in the group’s possession and ready for release. Those claims should be treated as unverified until corroborated by the affected organisation or by independent investigation. Nothing in the facts supplied for this incident goes beyond clop’s listing of RADISSONHOTELSAMERICAS.COM and its assertion that internal data was stolen.

RADISSONHOTELSAMERICAS.COM and its sector

RADISSONHOTELSAMERICAS.COM is associated with the Radisson hotel brand’s presence in the Americas. Hotel and hospitality organisations manage reservations, guest profiles, loyalty programmes, corporate accounts, and the operational systems that keep properties running. They commonly hold names, contact details, stay histories, payment card data or tokens, identification documents for certain bookings, and internal business records covering staff, suppliers, and partners.

A breach claim against any entity in this sector raises concern because the same systems that enable smooth check-in and personalised service also concentrate sensitive personal and financial information. Even when the exact data set remains unconfirmed, the nature of hotel operations means that unauthorised access can affect travellers, employees, and commercial counterparties whose details are stored for legitimate business reasons.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack and that clop claims to have stolen internal data. No further breakdown of file types, databases, or specific data elements has been disclosed. It is therefore not possible to state as fact which categories of information—guest records, payment data, employee files, contracts, or other materials—were or were not included.

Organisations of this kind typically maintain reservation systems, customer-relationship databases, payment-processing records, human-resources files, and a range of internal operational documents. Any of those could theoretically fall under the broad description “internal files.” Until a detailed inventory is published by the organisation or confirmed through reliable investigation, the exact contents remain unconfirmed. Readers should treat claims of specific data exposure with caution when they are not backed by primary disclosure.

What's at stake

For individuals, the concrete risks that follow from a hospitality-related data incident include phishing and social-engineering attempts that reference real stays or loyalty accounts, fraudulent use of payment details if card data was involved, and identity-related misuse if government ID or similar documents were stored. Even limited internal files can contain enough context—names, email addresses, phone numbers, travel patterns—to make subsequent scams more convincing.

For the organisation, the stakes include operational disruption, regulatory scrutiny where personal data protection laws apply, contractual obligations to partners and payment processors, and the longer-term cost of investigation, notification, and remediation. Because the number of people affected is unknown and the data types are described only in general terms, the full scale of these consequences cannot yet be measured from public information alone.

What to do if you're exposed

If you have stayed at, worked for, or done business with properties linked to RADISSONHOTELSAMERICAS.COM, treat the listing as a reason for heightened caution rather than proof that your specific records were taken. Monitor bank and card statements for unfamiliar charges. Be sceptical of unexpected emails, texts, or calls that claim to relate to a hotel booking, refund, or account problem; verify through official channels you already trust. Consider placing fraud alerts or credit freezes if you believe identity data may have been involved. Change passwords on any accounts that reused credentials connected to hotel or loyalty logins, and enable multi-factor authentication where available.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it can surface other exposures that warrant the same practical precautions.

AICompiled with AI assistance from public sources and published under our editorial standards.