NKAR Travels & Tours listed on payload ransomware leak site

• Ransomware group: payload
• Country: Sri Lanka
• Sector: Hospitality
• Announcement date: March 30, 2026

The Sri Lankan hospitality firm NKAR Travels & Tours has been listed on a leak site associated with the threat actor known as payload. According to an announcement published on March 30, 2026, the group claims to have gained unauthorized access to the organization's systems and asserts that they are in possession of a significant volume of data belonging to the entity.

The claimed attack and event details

The threat actor group, identified as payload, published an announcement on its leak site on March 30, 2026. Through this listing, the group asserts that they have successfully achieved unauthorized access to the internal systems of NKAR Travels & Tours. The announcement, which is categorized as a data leak notification, serves as the primary source for the group's claims regarding the breach.

The group claims that the attack took place on the same day the announcement was published, March 30, 2026. While the listing confirms the group's intent to publicize the incident, specific details regarding the exact method of entry or the specific nature of the unauthorized access have not been provided in the public announcement.

Data involved in the alleged breach

The payload group has made specific claims regarding the volume of information they have allegedly exfiltrated from the organization. According to the information provided on the leak site, the total volume of the data claimed to be stolen is 60 GB. This volume is supported by screenshots provided by the threat actor.

Despite the significant size of the data volume mentioned, the listing does not provide specific details regarding the nature or the specific types of data that have been allegedly leaked. The announcement does not specify whether the information includes personal identifiers, financial records, or internal corporate documents. Consequently, the exact contents of the 60 GB of data remain unconfirmed and unspecified.

Organization profile

NKAR Travels & Tours, which operates under the domain nkartravelhouse.com, is a premier travel agency based in Sri Lanka. The company provides a wide range of tourism-related services to its clientele. Their service offerings include various travel packages such as cultural tours, wildlife excursions, wedding travel arrangements, and luxury travel packages.

Potential impact and industry considerations

This incident may lead to operational disruptions for the organization and could negatively impact customer trust. Depending on the nature of the leaked data, risks such as identity theft or targeted phishing attacks against the travel agency's clients may emerge. Given the organization's location in Sri Lanka, it is possible that challenges regarding compliance with local data protection regulations may arise.

Public information regarding the payload group is limited; therefore, the group's motivations and historical activities remain uncertain. Groups employing double-extortion tactics may aim to exert pressure on the organization by threatening to publish sensitive data. In such scenarios, the threat actor typically encrypts the victim's data and simultaneously steals a copy to use as leverage for ransom demands.

For organizations operating within the hospitality and travel sector, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities. Protecting client data is particularly critical in the travel industry, as the information handled often includes sensitive personal and financial details necessary for booking international services.