NewHotel cloud company targeted by ralord ransomware group

• Ransomware group: ralord
• Country: Spain
• Sector: Hospitality
• Announcement date: April 15, 2025

The ralord ransomware group claims a major data breach at NewHotel cloud company

The ransomware group known as ralord has announced a significant data breach involving NewHotel cloud company. According to a post published on a leak site on April 15, 2025, the threat actors claim to have successfully compromised the company's systems and exfiltrated a substantial amount of sensitive information. The group asserts that the volume of stolen data amounts to 60GB.

In modern cyberattack landscapes, such incidents often follow the pattern of double extortion. This tactic involves two stages: first, the attackers infiltrate a network to encrypt critical systems, and second, they steal sensitive data to use as leverage. By threatening to publish this information on a public leak site, ransomware groups attempt to pressure organizations into paying a ransom to prevent the exposure of proprietary or personal information.

Details of the claimed attack and data exfiltration

The threat actor's announcement, dated April 15, 2025, suggests a wide-reaching compromise. Beyond the primary target, the group also claims that the breach has affected secret reports and plans belonging to other companies. This indicates that the scope of the incident may extend beyond the immediate infrastructure of NewHotel cloud company, potentially impacting a broader network of users or clients.

While the specific details regarding the method of entry or the exact timing of the initial compromise remain unconfirmed, the group has provided a detailed list of the types of data they claim to have stolen. According to the information provided by the attackers, the leaked data includes a wide variety of sensitive files and identifiers, such as:

• Secret reports
• Private plans
• Recipes
• Excel files
• Project sources
• Partner info
• Payments
• Project and source codes
• Government data
• Gmail addresses
• Phone numbers
• IDs

The presence of such diverse data types—ranging from technical source code to personal identification and financial information—suggests a deep level of access within the targeted environment.

About NewHotel cloud company

NewHotel Software is a technology company that develops cloud-based Property Management Systems (PMS) to digitize hotel management and operations. It provides comprehensive software solutions for the hospitality industry. Given its role in providing digital infrastructure for hotel operations, the company serves as a critical component in the technological ecosystem of the hospitality sector.

Potential impact and industry implications

The nature of the services provided by NewHotel cloud company means that this alleged leak could create significant operational risks for other stakeholders within the hospitality sector. Because the company provides cloud-based management solutions, a breach of this magnitude could potentially disrupt the service chain or expose the data of the hotels that rely on their software.

The specific types of data claimed to be stolen—such as IDs, phone numbers, and Gmail addresses—could lead to identity theft or highly targeted phishing attacks against individuals or business partners. Furthermore, the theft of project and source codes could pose a long-term security risk to the software itself. From a regulatory perspective, the nature of the leaked data could result in legal proceedings regarding the company's compliance with data protection regulations.

Until the claims made by the ralord group are independently verified, this situation increases the overall supply chain risk for the industry. Organizations in this sector can mitigate such risks by implementing robust security frameworks, such as multi-factor authentication, strict access controls, and continuous monitoring of cloud environments. Maintaining regular, offline backups and conducting thorough third-party risk assessments are also essential defensive steps for organizations relying on cloud-based service providers.