Gandía Palace Hotel listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Spain
• Sector: Hospitality
• Announcement date: December 3, 2025

Qilin ransomware group targets Gandía Palace Hotel

The Qilin ransomware group has listed the Gandía Palace Hotel on its dedicated leak site, claiming to have successfully exfiltrated data from the organization. This announcement, made on December 3, 2025, marks a new development in the group's ongoing activities targeting various sectors.

Ransomware groups often use leak sites to pressure victims into paying ransoms by threatening to release sensitive information. This tactic is a cornerstone of modern cyber extortion, where the threat of a public data breach serves as leverage against the targeted entity.

Details of the claimed attack

According to the announcement made by the threat actor known as Qilin, the group gained unauthorized access to the organization's data following a cyberattack that allegedly took place on October 26, 2025. The group has shared screenshots of the allegedly exfiltrated documents as part of their public announcement to support their claims.

While the group has provided visual evidence through these screenshots, there is no clear information regarding the full scope of the incident or the specific types of the leaked data. The presence of such screenshots is a common method used by ransomware operators to demonstrate the validity of their breach to both the victim and the public.

Potential data involvement

The screenshots shared on the leak site suggest that documents related to the organization's operational and administrative processes may have been exfiltrated. However, the listing does not provide specific details regarding the volume of the data or the exact file count involved in the incident. Furthermore, no specific ransom demand has been disclosed in the current announcement.

• Operational and administrative documents

The listing does not name any other specific data types beyond these general categories of operational and administrative processes.

About Gandía Palace Hotel

Gandía Palace Hotel is a hotel and entertainment complex located in Gandia, Spain. The facility provides accommodation services as well as event hosting and nightlife amenities.

Implications and industry risks

The Qilin group is known as a cybercrime organization that has been active since 2022 and employs double extortion tactics. Double extortion refers to a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release, thereby increasing the pressure to pay the ransom.

Such a leak may lead to the exposure of personal data belonging to Gandía Palace Hotel's customers and employees. Consequently, the organization could face data breach notification obligations under the European Union's General Data Protection Regulation (GDPR). Beyond legal compliance, the leaked data could be used for identity theft or targeted phishing attacks, which may create negative impacts on the organization's commercial reputation.

In the hospitality sector, organizations often handle significant amounts of sensitive customer information, including personal identification and payment details. To mitigate such risks, organizations in this sector typically focus on robust security measures, such as implementing multi-factor authentication, maintaining rigorous patch management, and conducting regular employee awareness training to prevent phishing-based initial access.