Gurney's Resorts listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Hospitality
• Announcement date: September 18, 2025

Gurney's Resorts targeted by Akira ransomware group

The Akira ransomware group has listed Gurney's Resorts on its dedicated leak site, claiming to have successfully exfiltrated a significant amount of corporate data. According to the announcement made on September 18, 2025, the threat actor group asserts that they have obtained approximately 20 GB of data from the organization's systems.

Details of the alleged attack

The incident involving Gurney's Resorts is reported to have occurred on September 15, 2025. The Akira group has published a notice on their leak site indicating their intent to release the stolen information. This type of activity is characteristic of modern ransomware operations, which often employ a double-extortion tactic. In such scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive data to use as leverage, threatening to publish it publicly unless a ransom is paid.

The group's claim suggests a targeted operation aimed at extracting high-value information from the organization's infrastructure. While the announcement was made several days after the initial incident, the volume of data claimed—20 GB—indicates a substantial breach of the target's digital environment.

Potential data compromise

The leak announcement claims that a wide variety of sensitive information has been compromised. The data allegedly stolen includes highly personal details belonging to both employees and clients, which could lead to significant privacy violations. The following types of data are reportedly included in the breach:

• Employee passport information
• Employee address information
• Employee Social Security Numbers (SSNs)
• Employee contact details
• Employee medical records
• Client dates of birth
• Client contact details
• Client room numbers
• Finance and accounting files
• Non-disclosure agreements (NDA)

It is important to note that no screenshots were provided by the group to verify the authenticity of the stolen files. The inclusion of medical records, financial documents, and personal identifiers like SSNs and passport details represents a severe breach of confidentiality for the affected individuals.

About Gurney's Resorts

Gurney's Montauk Resort & Seawater Spa is a luxury beach hotel and spa center located in Montauk, New York. The property offers accommodation services with ocean-view rooms, suites, and beachfront cottages, serving a high-end clientele in the hospitality sector.

Risks and security implications

This incident may pose secondary risks such as identity theft and targeted phishing attacks for the organization's employees and clients. The alleged compromise of medical and financial data could lead to legal and administrative sanctions for the organization under US state laws and federal regulations. Given the Akira group's double-extortion method, the publication of this data may result in significant reputational damage.

Considering the group's tendency to exploit VPN accounts, it is assessed that there may be vulnerabilities in the organization's network security processes. For organizations in the hospitality sector, such incidents highlight the critical importance of robust network security and identity management. Protecting remote access points, such as VPNs, is a vital defensive step to prevent unauthorized entry. Furthermore, organizations must prioritize data security measures and ensure they are prepared to notify affected parties in the event of a breach to mitigate legal and reputational fallout.