Westmont Hospitality Group Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target large service organisations whose operations span multiple properties and jurisdictions, using data theft as leverage alongside system disruption. In late January 2023, the group known as alphv publicly listed Westmont Hospitality Group among its claimed victims, asserting that internal files had been taken in a ransomware attack. The number of people affected remains unknown, and independent confirmation of the full scope has not been made public.

For guests, employees, and business partners of a major hospitality operator, any such claim raises practical questions about what information may have left the organisation’s control and what steps are worth taking while details stay limited.

Inside the incident

According to reporting dated 31 January 2023, Westmont Hospitality Group appeared on the leak site operated by the alphv ransomware group. The group claimed that internal files had been exfiltrated during a ransomware attack. No public figure has been given for the volume of data, the precise date the intrusion began or ended, or the technical method used to gain access. The number of individuals whose information may be involved is listed as unknown. Beyond the group’s own listing, further forensic or company-confirmed particulars have not been disclosed in the available record.

In common with many ransomware incidents of this period, the public signal consisted primarily of the threat actor’s assertion that data had been stolen and that the victim had been named. Whether negotiations occurred, whether any ransom was paid, or whether systems were encrypted in addition to the claimed exfiltration are all points on which the public record is silent.

Who is alphv?

Alphv, also widely known as BlackCat, is a ransomware operation that emerged in late 2021 and became one of the more active groups through 2022 and into 2023. It operated as a ransomware-as-a-service model, recruiting affiliates who conducted intrusions and shared proceeds with the core developers. The group was notable for using a Rust-based encryptor, for maintaining a Tor-based leak site on which it named victims and sometimes published sample data, and for frequently combining encryption with data theft to increase pressure.

Alphv affiliates typically gained initial access through stolen credentials, exploited vulnerabilities, or phishing, then moved laterally, escalated privileges, and exfiltrated material before deploying ransomware. The group claimed responsibility for attacks across multiple sectors, including manufacturing, professional services, and hospitality. Its public listings are claims made by the actors themselves; they are not independent verification that every asserted detail is accurate. Law-enforcement actions later disrupted parts of the operation, but at the time Westmont Hospitality Group was named, alphv remained an active and high-profile threat.

Who is Westmont Hospitality Group?

Westmont Hospitality Group was founded in 1975. The company provides hotel management and related facility services. Organisations of this type typically oversee or support portfolios of hotels and other lodging or commercial properties, handling operations that can include guest services, property management, vendor relationships, and corporate administration across multiple locations.

A breach affecting such a group is consequential because hospitality operators routinely process and store information about guests, employees, and commercial partners. Even when the precise contents of a claimed theft are unconfirmed, the sector’s reliance on reservation systems, loyalty programmes, payment processing, and human-resources records means that any successful intrusion carries potential downstream effects for individuals and for the continuity of multi-property operations.

The information in question

The available facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data categories—such as guest records, payment card data, employee files, or contracts—has been publicly detailed or independently confirmed. The exact contents therefore remain unconfirmed.

Organisations engaged in hotel management and facility services commonly hold a range of sensitive material: guest contact and reservation details, payment-related information, employee personal and payroll data, vendor and franchise agreements, and internal operational documents. Whether any or all of those categories were among the files claimed by alphv is not established in the public record. Readers should treat the exposure as involving internal corporate material whose precise composition has not been disclosed.

The real-world impact

For individuals, the principal risks associated with a hospitality-sector ransomware claim are identity misuse, phishing that leverages stolen personal or booking details, and potential fraud if financial or authentication data were among the files taken. Because the number of people affected is unknown and the data types are not itemised, it is not possible to state how widely those risks apply. People who have stayed at properties managed by the group, worked for it, or done business with it may reasonably treat the incident as a prompt to monitor accounts and communications more closely.

For the organisation, a public ransomware listing can disrupt operations, strain relationships with property owners and partners, and trigger regulatory or contractual notification duties depending on jurisdiction and the nature of any confirmed personal data. Recovery typically involves forensic investigation, system restoration, and communication with affected parties—steps whose progress and findings are not detailed in the material available here. No public confirmation of negligence or specific security failings has been established as fact.

Were you affected?

If you have been a guest, employee, or partner of Westmont Hospitality Group, practical first steps include watching bank and credit-card statements for unfamiliar charges, treating unsolicited messages that reference stays or employment with caution, and enabling multi-factor authentication on email and financial accounts where available. Consider placing fraud alerts with credit bureaus if you believe personal identifiers may have been involved. Because the scale and contents of the claimed theft remain undisclosed, these measures are precautionary rather than a response to confirmed individual exposure.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That check will not confirm or rule out involvement in this specific incident, but it can indicate whether your address has surfaced elsewhere and help you prioritise password changes and monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.