Inns of Aurora listed on BlackSuit ransomware leak site

• Ransomware group: BlackSuit
• Country: United States
• Sector: Hospitality
• Announcement date: May 29, 2025

BlackSuit claims data theft from Inns of Aurora

The BlackSuit ransomware group has officially listed the hospitality provider Inns of Aurora on its dedicated leak site. According to the announcement made on May 29, 2025, the threat actors claim to have successfully exfiltrated a significant volume of data belonging to the organization. This disclosure follows the group's pattern of naming victims to exert pressure during extortion attempts.

The incident was announced on the group's leak site on May 29, 2025, with the group claiming the attack occurred on the same day. BlackSuit, which is considered to be a successor to the Royal group, appears to be using this public listing as a method to increase pressure on the organization. Such tactics are characteristic of modern ransomware operations, where the threat of leaking sensitive information is used as leverage to compel organizations into meeting ransom demands.

Details of the claimed data exfiltration

While the group has made a significant claim regarding the volume of information stolen, specific details regarding the exact content of the leaked data have not been provided. The announcement focuses primarily on the scale of the breach rather than the specific categories of information involved.

The following details have been provided by the threat actor:

• Claimed data size: 200 GB

The listing names no specific data types or individual files that have been compromised. Beyond the stated size of 200 GB, no further information regarding the contents of the stolen data has been disclosed by the attackers.

About Inns of Aurora

Inns of Aurora is a luxury boutique hotel and resort located in the Finger Lakes region of New York. The organization consists of several historic properties and provides a variety of high-end services to its guests, including lodging, dining, and spa services.

Risk assessment and industry implications

This incident may pose significant risks to the organization's operational processes and customer trust. Because the organization is based in the United States, any potential data breach may be subject to various state-level data protection regulations. The exposure of such data could lead to secondary risks for both employees and customers, such as identity theft or targeted phishing attacks.

Given the past activities of the BlackSuit group, it is possible that the organization has been subjected to double extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. This dual-threat approach increases the pressure on the victim, as they must contend with both operational downtime and the potential for regulatory fines and reputational damage.

For organizations operating within the hospitality sector, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining rigorous patch management schedules, and ensuring comprehensive offline backups. Furthermore, monitoring for unauthorized data exfiltration and maintaining a clear incident response plan are essential for mitigating the impact of such sophisticated threats.