southamericantours.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target travel and hospitality firms because those businesses hold dense stores of customer, partner and operational data and often rely on interconnected booking systems. Against that backdrop, southamericantours.com appeared on a LockBit3 leak site in early 2023, adding another destination-management company to the list of organisations claimed as victims in double-extortion campaigns.

Public reporting on 10 March 2023 stated that the site had been listed by the LockBit3 ransomware group and that internal files had been exfiltrated. The number of people affected remains unknown, and further technical detail has not been released. The listing itself is a claim by the group; independent confirmation of the full scope has not been published.

Breaking down the breach

According to the available record, southamericantours.com was listed by LockBit3 on or about 10 March 2023. The only data description supplied is that internal files were allegedly exfiltrated in a ransomware attack. No figure for the volume of data, no inventory of file types beyond that general label, no intrusion timeline, and no statement of whether encryption was also deployed have been disclosed in the material at hand. The count of individuals potentially affected is recorded as unknown.

Because the public account stops at the leak-site listing and the bare assertion of internal-file exfiltration, it is not possible to state with certainty how the attackers gained access, how long they remained inside the environment, or whether any ransom demand was met or refused. Those particulars remain undisclosed.

Inside lockbit3

LockBit3 is the name associated with a long-running ransomware-as-a-service operation that has been tracked by law-enforcement and security researchers for several years. The group is known for a double-extortion model: after gaining access, operators typically exfiltrate data and then encrypt systems, threatening to publish the stolen material on a dedicated leak site if payment is not made. Affiliates often obtain initial access through phishing, exploited vulnerabilities or compromised remote-access credentials, after which they move laterally and stage data for theft.

LockBit3 has claimed responsibility for attacks across many sectors and geographies; its leak site has been used repeatedly to pressure victims by posting sample files or full archives. In this instance the group’s listing of southamericantours.com constitutes its claim that the organisation was compromised and that internal files were taken. No additional statements attributed to LockBit3 about this specific victim appear in the supplied facts, and the claim should be treated as unverified pending independent corroboration.

About southamericantours.com

South American Tours, operating as southamericantours.com and often abbreviated SAT, describes itself as a destination-management company active since 1973. It specialises in tailor-made tours and travel arrangements for groups and individual travellers, covering round trips, packages, incentives and cruises across South America. Organisations of this type sit between international tour operators, local suppliers and end customers; they routinely handle booking records, traveller itineraries, passport and contact details, payment references, and contracts with hotels, transport providers and guides.

A breach at a DMC is consequential because the same systems that coordinate complex multi-country trips also concentrate personal and commercial data. Disruption can affect not only the company’s own staff and finances but also the travellers whose journeys depend on those arrangements and the partner businesses that rely on timely information and payment.

What was likely exposed

The facts state only that internal files were exfiltrated. No further breakdown—customer databases, financial records, employee files, or other categories—has been published. Exact contents therefore remain unconfirmed.

Companies in the destination-management sector typically hold traveller names and contact information, passport or identity-document copies, travel dates and itineraries, emergency contacts, billing and payment data, supplier contracts, and internal correspondence. Any of those categories could have been present among the internal files, but that possibility is inferred from normal business practice rather than from a disclosed inventory. Until a fuller accounting is released, affected individuals and partners cannot know with precision what, if anything, of theirs was taken.

Why it matters

For travellers and corporate clients, exposure of booking or identity data can raise the risk of targeted phishing, identity fraud or misuse of passport details. Even partial itineraries can reveal when people are away from home. For the organisation, loss of internal files can mean operational disruption, strained supplier relationships, regulatory notification duties where personal data are involved, and lasting damage to commercial trust.

Because the scale of the incident is unknown, the practical impact ranges from limited internal inconvenience to broader exposure of customer and partner information. The absence of confirmed numbers does not remove the need for vigilance; it simply means that anyone who has dealt with the company around the relevant period has reason to treat the claim seriously while awaiting clearer information.

What to do if you're exposed

If you have booked travel or shared personal details with southamericantours.com, monitor bank and card statements for unfamiliar charges and treat unsolicited messages that reference your trips or bookings with caution. Consider placing fraud alerts with credit bureaus if you are in a jurisdiction that offers them, and change passwords on any accounts that may have reused credentials linked to travel bookings. Keep copies of your own itineraries and payment records so you can spot discrepancies quickly.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step will not confirm or rule out involvement in this specific incident, but it can show whether your address is circulating more widely and help you prioritise further protections.

AICompiled with AI assistance from public sources and published under our editorial standards.