Fun For Less Tours targeted by Anubis ransomware group

• Ransomware group: Anubis
• Country: United States
• Sector: Hospitality
• Announcement date: December 1, 2025

The Anubis ransomware group has published an announcement on its leak site claiming to possess data belonging to Fun For Less Tours. This development follows a pattern often seen in modern cyberattacks where threat actors use public platforms to pressure organizations by threatening to release sensitive information.

The claimed attack event

On December 1, 2025, the Anubis group listed Fun For Less Tours on its leak site. According to the group's announcement, they have successfully gained access to the organization's systems and obtained various data. The group's claim suggests a successful breach of the company's digital infrastructure.

While the group has made this public claim, the specific details regarding the potential publication or sale of this data remain unclear. In many ransomware scenarios, groups utilize a method known as double extortion. In this model, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak the data on a public site, the attackers aim to maximize the pressure on the victim to meet their demands.

Compromised data types

The announcement made by the Anubis group specifies that certain sensitive information has been compromised. While no screenshots were provided to verify the contents of the breach, the group claims that the following types of information are involved:

• Customer passport information
• Personal data

The presence of such highly sensitive documents in a breach is a significant concern for the affected parties. When passport details are part of a leak, the risk of the information being used for secondary attacks or targeted phishing campaigns increases significantly.

Organization profile

Fun For Less Tours is a US-based travel agency that organizes guided group tours and vacation packages worldwide. The company focuses on providing affordable and comprehensive travel experiences to its customers.

Impact and implications

This incident may pose significant risks of identity theft and fraud for Fun For Less Tours customers. Because the organization is based in the United States, the breach may trigger specific legal obligations. Data breach notification requirements under various state laws and federal regulations may be activated depending on the nature of the data and the residency of the affected individuals.

The potential misuse of leaked passport information is a primary concern, as it can be utilized by malicious actors for various fraudulent activities. Furthermore, the organization may face negative impacts regarding its operational continuity and reputation management. Maintaining customer trust is vital for service providers, and a public claim of a data breach can have lasting effects on a company's public image.

In general, organizations in the hospitality and travel sectors can take several defensive steps to mitigate such risks. Implementing robust multi-factor authentication (MFA) across all systems, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees are standard industry practices. Additionally, encrypting sensitive customer data at rest and in transit can help ensure that even if a breach occurs, the stolen data remains unreadable to unauthorized parties. As information regarding the Anubis group remains limited, organizations must remain vigilant against the evolving tactics used by such threat actors.