The Seacare Hotel Listed by lamashtu Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 13, 2026, the lamashtu ransomware group listed The Seacare Hotel on its leak site. The listing states that internal files were exfiltrated during a ransomware attack. No information has been released on the number of individuals affected or the precise volume of data involved. The incident reflects a continuing pattern in which ransomware operators target hospitality businesses and publish claims of data theft on dedicated leak sites when ransom demands are not met.

Inside the incident

Public reporting on the event is limited to the group’s listing of The Seacare Hotel. The date the files were taken and the method of initial access have not been disclosed. It is also not known whether encryption was deployed in addition to the exfiltration of internal files.

The group behind it: lamashtu

Lamashtu is a ransomware operator that follows the double-extortion model common among current threat actors. After gaining access to a network, the group typically copies selected data and later publishes samples or file listings on its leak site if payment is not received. The group’s listing of The Seacare Hotel constitutes a claim by the actor; independent confirmation of the data’s authenticity or scope has not been made public.

The Seacare Hotel and its sector

The Seacare Hotel operates in Singapore’s hospitality sector, with premises near major tourist districts. Hotels routinely maintain systems that store guest reservations, payment records, identification documents, and internal operational documents. A breach affecting such an organisation can expose both customer information and business records that are not normally visible to the public.

What data was at risk

The only detail released is that internal files were allegedly exfiltrated. The exact categories of information contained in those files have not been published. Organisations of this type commonly hold names, contact details, passport or identity numbers, payment card data, and booking histories, but it remains unconfirmed whether any of these specific data types were among the material taken.

The real-world impact

Individuals whose information appears in the exfiltrated files face the possibility of phishing, account takeover attempts, or fraudulent transactions. The organisation may encounter regulatory inquiries, costs associated with investigation and notification, and loss of customer trust. Because the number of records and the sensitivity of the contents are not yet known, the scale of these consequences cannot be quantified from currently available information.

Were you affected?

Guests who stayed at The Seacare Hotel or conducted business with it should monitor their financial accounts and email for unusual activity. Enabling multi-factor authentication on any accounts that may be linked to the hotel is a prudent step. Individuals can also run a free exposure scan of their email address against known breach data to determine whether their information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.