Atlas Ocean Voyages targeted by Insomnia ransomware group

• Ransomware group: Insomnia
• Country: United States
• Sector: Hospitality
• Announcement date: March 23, 2026

The ransomware group known as Insomnia has officially listed the luxury travel company Atlas Ocean Voyages on its leak site. According to an announcement made on March 23, 2026, the group claims to have successfully breached the organization's systems and has published data that allegedly belongs to the company.

The claimed attack and data leak

The Insomnia group released a leak announcement regarding Atlas Ocean Voyages, claiming that the initial attack occurred on February 27, 2026. The group asserts that they have obtained various documents and data from the organization's internal systems. Following the breach, the group has made this information publicly available on their dedicated leak site.

The announcement indicates that information related to the organization's operational processes has been exposed. While the group has published samples to demonstrate the scope of the theft, the specific total volume of the data and the exact file count have not been disclosed by the attackers. Furthermore, there is no information available regarding a specific ransom demand or the total amount of data stolen.

Based on the screenshots and samples provided by the group, the leaked information is quite sensitive. The data reportedly includes various types of personal and logistical information, such as:

• Guest personal information
• Contact details
• Reservation details

The samples shared by the threat actors specifically highlight the presence of guest information forms, personal contact details, addresses, dates of birth, and tables containing travel reservation details. These elements suggest that the breach has compromised the private information of individuals traveling with the company.

About Atlas Ocean Voyages

Atlas Ocean Voyages is a travel company that specializes in offering all-inclusive expedition cruises. Their services are provided on luxury yachts with a capacity of fewer than 200 guests, allowing for a more intimate travel experience. The company's itineraries are designed to sail from pole to pole, focusing on nature, culture, and culinary-themed excursions. These trips are led by expert guides and are aimed at reaching remote destinations across the globe.

Potential impacts and organizational risks

This breach may pose significant secondary risks to the individuals whose information was exposed. Specifically, the theft of contact details, addresses, and reservation information can lead to identity theft and targeted phishing attacks. When attackers possess specific details like dates of birth and travel plans, they can craft highly convincing social engineering campaigns to deceive victims.

Because Atlas Ocean Voyages is based in the United States, this incident may trigger various legal processes. These could be governed by relevant state laws and federal data protection regulations regarding the handling of consumer information. The exposure of such data can have a lasting negative impact on customer trust and could potentially jeopardize the operational continuity of the organization.

In the broader context of cybersecurity, this incident reflects the common pattern of double extortion used by ransomware groups. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage for extortion. By threatening to release private data on a public leak site, the group increases the pressure on the victim to meet their demands.

While public information regarding the specific tactics and capabilities of the Insomnia group remains limited, this event highlights the ongoing risks faced by the hospitality sector. Organizations in this sector often handle high volumes of sensitive personal and financial data, making them attractive targets for cybercriminals. To mitigate such risks, organizations typically focus on strengthening their defensive posture through robust access controls, regular security audits, and comprehensive employee training to prevent initial access via phishing or other common vectors.

The organization involved may be required to fulfill specific legal obligations, such as data breach notification requirements, to inform the affected individuals about the compromise of their personal information.