Holiday Tours listed on sinobi ransomware leak site

• Ransomware group: sinobi
• Country: United States
• Sector: Hospitality
• Announcement date: December 16, 2025

Sinobi ransomware group targets Holiday Tours

The ransomware group known as sinobi has officially listed the hospitality organization Holiday Tours on its dedicated leak site. According to the announcement, the threat actors claim to have successfully compromised the company's data, marking a new escalation in their targeting activities. This listing serves as a public claim by the group, asserting that they have gained unauthorized access to the organization's internal systems.

Details of the claimed attack

The threat actor known as sinobi published the announcement on December 16, 2025. In the post, the group issued a significant ransom demand, claiming they are seeking a payment of 7,500,000 USD to prevent further exposure or to restore access. To support their claims of a successful intrusion, the group included screenshots in their post that allegedly depict the internal network infrastructure of the organization.

In the context of modern cybercrime, such actions are often part of a double extortion strategy. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak stolen data on a public forum, the attackers aim to increase the pressure on the victim to meet their financial demands. This method shifts the focus from mere operational disruption to potential reputational and regulatory damage.

Data and evidence provided by the group

The evidence provided by the attackers on the leak site consists of screenshots showing various elements of the network. These images reportedly display file lists and server information that were allegedly accessed via the SMB protocol within the organization's network. While these screenshots provide a glimpse into the perceived extent of the breach, the group has not provided specific details regarding the types of data contained within the files.

• No specific data types were detailed in the provided samples.

About Holiday Tours

Holiday Tours is an established business in the hospitality sector, having been founded in 1978. Based in North Carolina, the company operates as a family-owned business. They provide a wide range of transportation and tourism solutions, specializing in motorcoach services, group travel, cruises, and air travel packages.

Potential impact and industry implications

The actions taken by the sinobi group could have several serious consequences for the organization. Such a breach may negatively impact the operational continuity of the company and could lead to a significant loss of customer trust. Furthermore, the claimed ransom amount of 7,500,000 USD could place substantial pressure on the company's financial resources and may lead to secondary extortion risks, where attackers attempt to leverage the data for multiple purposes.

Because the organization is based in the United States, any confirmed data breach could lead to complex legal proceedings under various state-level data protection laws and industry-specific regulations. For companies operating in the hospitality and travel sectors, maintaining robust cybersecurity postures is essential to mitigate these risks. General defensive measures often include implementing multi-factor authentication, maintaining offline backups, and conducting regular network segmentation to limit the lateral movement of attackers.

At this time, public information regarding the sinobi group remains limited. Due to this lack of available data, a definitive assessment regarding the group's specific methods or their past activities cannot be made. The incident highlights the ongoing threat posed by ransomware groups to established service providers in the tourism industry.