radissonhotelsamericas.com Listed by dispossessor Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target large consumer-facing organisations, using data theft as leverage even when encryption alone might not force a payment. In this climate, a listing on a criminal leak site is often the first public signal that an organisation has been hit. On 19 April 2024 the domain radissonhotelsamericas.com appeared on the leak site operated by the ransomware group known as dispossessor, which claimed to have exfiltrated internal files.

Public detail remains limited: the number of people affected is unknown, and no independent confirmation of the claim has been released. Still, any credible assertion that a major hospitality brand’s internal systems have been compromised raises immediate questions for guests, employees and partners whose information may have been stored there.

Breaking down the breach

According to the available record, radissonhotelsamericas.com was listed by the dispossessor ransomware group on 19 April 2024. The group’s claim states that internal files were exfiltrated in a ransomware attack. No further technical details—such as the initial access vector, the duration of the intrusion, the volume of data taken, or whether systems were encrypted—have been disclosed in the public summary. The number of individuals potentially affected is recorded as unknown. Because the sole source of the allegation is the group’s own leak-site posting, the incident should be treated as an unverified claim until the organisation or independent investigators provide confirmation.

No ransom demand amount, negotiation timeline or subsequent data dump has been described in the facts available. In short, the public record consists of a single listing date, the organisation’s domain, and the assertion that internal files left the network. Everything else remains undisclosed.

Inside dispossessor

Dispossessor is a ransomware operation that follows the now-familiar double-extortion model: after gaining access to a network, operators typically steal data before deploying encryption, then threaten to publish the stolen material on a dedicated leak site if payment is not made. Like other groups of this type, dispossessor maintains a public-facing blog or portal where it posts victim names, sample files and countdown timers. The tactic is designed both to pressure the victim and to advertise the group’s capabilities to other potential targets.

Public reporting on dispossessor has described it as one of several mid-tier ransomware crews that emerged or rebranded in the post-2022 landscape, often reusing code or infrastructure from earlier families. Its listings frequently name organisations across hospitality, manufacturing and professional services. The group’s claims about any specific victim—including radissonhotelsamericas.com—must be read as self-interested assertions rather than Reported Facts. No independent forensic report confirming the group’s access to this particular organisation has been cited in the available record.

radissonhotelsamericas.com and its sector

Radisson Hotels Americas operates under the broader Radisson Hotel Group umbrella, managing and franchising hotels across the Americas. The hospitality sector routinely processes large volumes of personal and financial data: guest reservation records, loyalty-programme profiles, payment-card details, employee personnel files, and corporate contracts with suppliers and travel partners. Even internal operational documents—staff rosters, security procedures, or network diagrams—can become valuable to criminals if they facilitate further fraud or social engineering.

A breach affecting a hotel brand is consequential because the data often spans multiple properties and jurisdictions, and because guests may not realise their information has been retained long after a stay. The sector has been a repeated target for ransomware groups precisely because downtime disrupts revenue and because the personal data held is readily monetisable on underground markets. Whether or not the dispossessor claim is ultimately substantiated, the mere listing places the organisation under public scrutiny and raises legitimate concern among anyone who has stayed at, worked for, or done business with Radisson properties in the Americas.

What data was at risk

The only data type named in the public record is “internal files exfiltrated in a ransomware attack.” No inventory of specific file categories, databases or record counts has been released. Organisations of this kind typically hold guest contact details, reservation histories, payment information, loyalty-account credentials, employee records and various operational documents. It is therefore possible that any of those categories could have been among the material claimed by the group. However, because the exact contents remain unconfirmed, no definitive statement can be made about which data elements, if any, left the network.

Readers should treat the phrase “internal files” as a broad and currently unverified claim rather than a precise description of exposed personal information.

What's at stake

For individuals, the principal risks are identity theft, phishing and account takeover. If guest or employee records were among the files taken, criminals could craft convincing messages that reference real stays or internal processes, increasing the chance that recipients will click malicious links or surrender credentials. Payment-card data, if present, could be used for fraudulent transactions until cards are reissued. Even non-financial internal documents can enable social-engineering attacks against the organisation’s staff or partners.

For the organisation itself, the stakes include potential regulatory scrutiny under data-protection laws, contractual obligations to franchisees and corporate clients, reputational damage, and the operational cost of investigation and remediation. Because the scale of any exposure is unknown, the full extent of these consequences cannot yet be quantified. The absence of confirmed numbers does not eliminate the risk; it simply means the risk remains unmeasured.

What to do if you're exposed

Anyone who has stayed at, worked for or held an account with Radisson Hotels Americas should treat the listing as a prompt for basic hygiene rather than confirmed compromise. Monitor bank and credit-card statements for unfamiliar charges, enable multi-factor authentication on email and loyalty accounts, and be sceptical of unsolicited messages that claim to relate to a hotel stay or internal company matter. Consider placing a fraud alert with the major credit bureaus if you believe sensitive personal data may have been involved. Finally, you can run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; doing so provides an early indication of whether your credentials or contact details are circulating more widely.

AICompiled with AI assistance from public sources and published under our editorial standards.