Aman Resorts targeted in alleged data leak by shinyhunters

• Ransomware group: shinyhunters
• Country: Singapore
• Sector: Hospitality
• Announcement date: April 19, 2026

The shinyhunters ransomware group has published an announcement on a leak site claiming that Aman Resorts has been targeted in a cyberattack. According to the claims made by the threat actors, a significant amount of sensitive information has been compromised, potentially putting a large number of records at risk of being leaked to the public.

The details of the alleged attack

The announcement, which was posted on April 19, 2026, suggests that the breach occurred around April 18, 2026. The shinyhunters group alleges that they have successfully accessed and compromised data belonging to the luxury hospitality firm. While the group has made these claims, no screenshots or additional evidence were provided in the public announcement to verify the contents of the alleged breach.

The threat actors have employed a high-pressure tactic by setting a deadline for the organization. The group has threatened to release the stolen data and cause further digital disruptions if a ransom is not paid by April 21, 2026. This approach is a hallmark of modern ransomware operations, where the threat of public exposure is used as a primary tool for coercion.

The data involved in the claim

The shinyhunters group claims that the breach involves a substantial volume of information stored within the organization's systems. Specifically, the group alleges that over 500,000 Salesforce records have been compromised. The information reportedly includes:

• Personally identifiable information (PII)
• Salesforce records

It is important to note that the specific volume of files and the exact amount of data exfiltrated have not been disclosed by the group, and no specific ransom demand has been made public in the provided information.

About Aman Resorts

Aman Resorts is an international hospitality company that operates luxury hotels, resorts, and private residences worldwide. The company is widely recognized for its minimalist designs and its presence in exclusive, high-end locations across the globe.

Analysis and industry implications

This incident may pose a significant risk to the privacy of the organization's customers and employees. The alleged PII could potentially be exploited by malicious actors for identity theft and targeted phishing attacks. Because Aman Resorts is based in Singapore, the organization may face regulatory scrutiny under the Personal Data Protection Act (PDPA) following such an incident.

The strategy used by the shinyhunters group appears to be the double extortion method. In a double extortion scenario, attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information to threaten its public release. This method is intended to exert maximum pressure on an organization, as the threat of a data leak can cause irreparable reputational damage and legal consequences, even if the organization can restore its systems from backups.

For organizations operating in the hospitality sector, which handles vast amounts of sensitive guest information, such incidents highlight the critical importance of robust data protection strategies. Defensive measures typically include implementing strict access controls, monitoring for unauthorized data exfiltration, and ensuring that third-party integrations, such as CRM platforms like Salesforce, are secured with multi-factor authentication and rigorous auditing. Furthermore, maintaining a clear incident response plan and ensuring compliance with regional data protection laws, such as Singapore's PDPA, are essential components of a modern cybersecurity posture.