Hoteldelfinolugano.ch listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Switzerland
• Sector: Hospitality
• Announcement date: October 9, 2026

Safepay claims data breach at hoteldelfinolugano.ch

The ransomware group known as Safepay has listed hoteldelfinolugano.ch on its leak site, alleging a data breach. This announcement, made on October 9, 2026, marks a significant escalation in the threat actor's campaign against the organization.

Details of the claim

According to the announcement made by the Safepay group, the threat actor claims to have obtained data from the organization. Following this claim, the group has initiated a countdown, a common tactic used by ransomware operators to exert pressure on their targets. This method is often associated with double extortion tactics, where attackers not only encrypt an organization's systems but also threaten to release sensitive information publicly to force a ransom payment.

In double extortion schemes, the threat actor leverages the fear of reputational damage and regulatory scrutiny. By setting a timer, the group aims to create a sense of urgency, hoping the organization will comply with their demands to prevent the exposure of their data to the public or its sale on dark web forums.

Information regarding the leaked data

At this time, no specific details or file samples regarding the nature of the allegedly leaked data have been provided by the group. The listing does not specify the volume of data or the specific types of files that have been compromised.

• No specific data types have been identified in the listing.

About hoteldelfinolugano.ch

Hotel Delfino Lugano is a hotel located in Lugano, Switzerland. The facility has been managed by the Haas family since 1972. Having been managed by the family for four generations, the facility provides hospitality services to its guests.

Analysis and potential implications

Given that the organization is based in Switzerland, a potential data breach may result in legal consequences under the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR). The exposure of customer information could increase the risk of identity theft and targeted phishing for individuals in the hospitality sector.

The use of double extortion by the Safepay group suggests that the organization's operational continuity and reputation may be at risk. When a threat actor targets a hospitality provider, the sensitivity of guest information—ranging from contact details to booking histories—makes the organization a prime target for such tactics.

In response to such incidents, organizations typically need to initiate forensic investigations to determine the scope of the breach and notify relevant data protection authorities. Defensive measures for organizations in this sector often include implementing robust encryption, maintaining offline backups, and conducting regular security awareness training to prevent initial access through phishing.