treehotel.co.uk Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 27 January 2025, the Swedish accommodation provider treehotel.co.uk appeared on a listing published by the ransomware group known as funksec. The group claims that internal files were taken during a ransomware attack. The number of people whose information may be involved remains unknown, and public detail on the precise contents is limited. For anyone who has stayed at or contacted the property, the practical stakes are straightforward: personal details held by a hospitality business can be misused for fraud, phishing or identity-related harm if they have left the organisation’s control.

Because the listing itself is an unverified claim by the threat actor, the full scope of the incident has not been independently confirmed in the available record. What is known is enough to warrant attention from guests, staff and partners who may have shared data with the site.

Inside the incident

According to the reported information, treehotel.co.uk was listed by funksec on 27 January 2025. The group states that internal files were exfiltrated as part of a ransomware attack. No further technical details—such as the initial access method, the duration of any intrusion, the volume of data taken, or whether systems were encrypted—have been disclosed in the public record. The number of individuals affected is listed as unknown. The incident is therefore known primarily through the threat actor’s own claim rather than through a detailed official disclosure.

Ransomware operations of this type typically involve both encryption of systems and the theft of data for leverage. In this case, only the exfiltration of internal files is named. Without additional confirmation, the exact sequence of events and the full extent of any compromise remain unconfirmed.

Who is funksec?

Funksec is a ransomware group that has operated by listing claimed victims on dedicated leak sites. Like many contemporary ransomware actors, it is associated with double-extortion tactics: encrypting systems while also removing data and threatening to publish it if a ransom is not paid. Public reporting on the group has described it as relatively recent in the ransomware landscape, often targeting organisations across different sectors and using leak-site postings to apply pressure. The group’s listings are claims made by the actors themselves; they do not automatically constitute independent verification that a breach occurred exactly as described or that every file named was in fact taken.

In the present case, the only specific assertion tied to treehotel.co.uk is the listing itself and the statement that internal files were exfiltrated. No additional claims by funksec about this particular victim—such as sample files, ransom demands or deadlines—are included in the available facts.

treehotel.co.uk and its sector

Treehotel.co.uk is an accommodation provider based in Sweden that offers lodging in custom-built tree houses designed to blend with the surrounding forest. Guests can stay in distinctive structures, including a UFO-themed room and a mirrored cube that provides panoramic views, and can take part in outdoor activities such as hiking, kayaking and fishing. The business therefore operates in the hospitality and tourism sector, specifically in a niche of experiential, nature-based lodging.

Organisations of this kind routinely hold guest reservation details, contact information, payment-related records, correspondence, and internal operational files. A breach involving internal files at such a provider is consequential because it can expose both customer data and business information, creating risks for individuals who have interacted with the property and for the organisation’s ability to maintain trust and continuity of service.

What was likely exposed

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No specific categories—such as guest lists, payment card data, employee records or contracts—are itemised, and the volume of data is not reported. Exact contents therefore remain unconfirmed.

Hospitality businesses of this type typically maintain booking systems, guest contact details, correspondence, staff records and operational documents. Any of these could fall under the broad description of internal files, but it would be inaccurate to treat any particular data type as confirmed. Readers should regard the exposure as involving internal material whose precise nature has not been publicly detailed.

The real-world impact

For individuals, the main risks are the possible misuse of personal information for targeted phishing, social-engineering attempts or identity fraud. Even limited contact or booking data can be combined with other sources to make fraudulent messages appear more credible. Because the number of people affected is unknown, anyone who has made a reservation, enquiry or payment through treehotel.co.uk has reason to remain alert rather than assume they are unaffected.

For the organisation, the consequences include potential disruption to operations, the cost of investigation and recovery, reputational damage, and possible regulatory attention under data-protection rules that apply to Swedish and European businesses. The absence of confirmed figures does not reduce the need for careful handling of the incident; it simply means the scale cannot yet be quantified from public sources.

Were you affected?

If you have stayed at, booked with or corresponded with treehotel.co.uk, consider the following practical steps:

• Monitor bank and card statements for unexpected charges and contact your provider promptly if anything appears unusual.
• Treat unsolicited emails, messages or calls that reference a stay or booking with caution; verify any request through official channels rather than links or numbers supplied in the message.
• Change passwords for accounts that may have used the same credentials or email address associated with the booking, and enable multi-factor authentication where available.
• Watch for phishing that uses personal details you may have shared with the hotel.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

Public detail on this incident remains limited to the funksec listing and the statement that internal files were taken. Further official confirmation, if it emerges, will provide a clearer picture. Until then, measured vigilance is the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.