krybit ransomware group lists lasultanahotels.com on its leak site

• Ransomware group: krybit
• Country: Morocco
• Sector: Hospitality
• Announcement date: September 12, 2026

Krybit claims a breach of La Sultana Hotel Group

The Morocco-based luxury hotel group La Sultana Hotel Group has been listed on a leak site by the threat actor known as krybit. The group has created an announcement on their leak platform by listing the domain lasultanahotels.com, claiming to have compromised the institution. This announcement was made on September 12, 2026, with the group claiming the attack occurred on the same date.

In many modern cyberattacks, ransomware groups utilize leak sites to pressure victims through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information publicly if a ransom is not paid. By listing a victim on a public platform, threat actors aim to damage the reputation of the target and increase the pressure to comply with their demands. While the specific details of the ransom demand and the exact volume of data involved remain unknown, the mere presence of an organization on such a site indicates a significant security incident claim.

Details of the claimed leak

The announcement made by the krybit group includes various details regarding the company's operations and internal structures. According to the post, the information disclosed includes details about the hotel locations, corporate contact details, and information regarding the reservation technology utilized by the group. Specifically, the listing highlights information regarding the CEO and sales managers.

The listing names the following types of affected data:

• Corporate contact information
• Executive details

It is important to note that the announcement does not provide detailed information regarding the specific content of any leaked files or datasets. While the group claims to have compromised the institution, the specific nature of the data exfiltrated remains unverified by the details provided in the leak post.

About La Sultana Hotel Group

La Sultana Hotel Group is a Morocco-based luxury boutique hotel chain established in 2000. The organization provides high-quality accommodation services aimed at discerning travelers, operating within the hospitality sector.

Risk assessment and industry implications

This incident may pose a risk to the operational security of the organization. The information disclosed or claimed to be leaked could potentially be utilized for targeted phishing attacks against company employees. For example, when executive details and corporate contact information are exposed, attackers can craft highly convincing social engineering campaigns to deceive staff members or partners.

Furthermore, the exposure of the reservation technology details used by the company may increase supply chain risks. When technical details regarding the software or systems used to manage bookings are made public, it can provide a roadmap for attackers to identify vulnerabilities within the organization's digital infrastructure or its third-party service providers.

In the hospitality sector, maintaining the confidentiality of operational processes and management details is critical for maintaining trust. Organizations facing such threats may need to inform their customers and employees in accordance with data protection regulations in Morocco. General defensive steps for organizations in this sector often include implementing multi-factor authentication, conducting regular security awareness training to prevent phishing, and ensuring that all reservation technologies are patched and monitored for unusual activity. Information regarding the krybit group remains limited, making it difficult to determine their specific tactics, techniques, and procedures beyond this single incident.