Best Hotels Spain listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Spain
• Sector: Hospitality
• Announcement date: December 18, 2025

Qilin ransomware group claims attack on Best Hotels Spain

The Qilin ransomware group has published an announcement on its leak site claiming to have compromised data belonging to Best Hotels Spain. This listing, which was published on December 18, 2025, marks a new incident involving the hospitality sector. The threat actor has released a series of documents and tables that they claim are part of the organization's internal operations, though the full scope of the breach remains unclear.

Details of the claimed breach

According to the announcement made by the Qilin group, the threat actor has successfully accessed sensitive information. To support their claim, the group has shared various sample documents and tables that allegedly belong to the organization. These samples serve as a demonstration of the data they claim to have exfiltrated during the attack.

While the group has provided these visual examples, there is no detailed information regarding the full scope or the specific nature of the data involved. The listing does not provide information regarding the total volume of files taken, the specific file count, or the amount of data exfiltrated. Furthermore, no ransom demand has been disclosed in the public announcement.

• The listing names no specific data types.

About Best Hotels Spain

Best Hotels is a hotel chain based in Spain. The organization operates numerous hotels and resorts across various tourist destinations throughout the country, making it a significant player in the Spanish hospitality industry.

Potential impact and security implications

This incident suggests that customer or operational data within Best Hotels Spain may have been compromised. Because the organization operates within Spain, a potential data breach of this nature could lead to legal sanctions under the European Union's General Data Protection Regulation (GDPR). The implications of such a breach extend beyond legal compliance, potentially affecting the organization's reputation and consumer trust.

The Qilin group typically employs a double extortion method. In such scenarios, attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage during ransom negotiations. This method indicates that the leaked data could potentially be used for secondary risks, such as identity theft or targeted phishing attacks against the organization's clients or employees.

For organizations operating in the hospitality sector, such incidents can lead to significant operational disruptions. To mitigate these risks, it is common for entities to implement robust defensive measures. These typically include maintaining offline backups, implementing multi-factor authentication (MFA) across all systems, and conducting regular security awareness training for staff to recognize phishing attempts. Maintaining a strong incident response plan is also a critical component of modern cybersecurity defense to minimize the impact of such breaches.