Noi Hotels listed on Qilin ransomware leak site following data breach allegations

• Ransomware group: Qilin
• Country: Chile
• Sector: Hospitality
• Announcement date: March 26, 2026

Noi Hotels has been listed on the leak site of the Qilin ransomware group, following allegations of a data breach. The group has published data they claim belongs to the organization, marking a significant potential security incident for the hospitality provider.

The alleged attack and group claims

The Qilin ransomware group has published data they claim belongs to Noi Hotels on their leak site. The group added the organization to their list on March 26, 2026. As part of the announcement, samples of various files allegedly obtained from the organization's internal network have been shared by the threat actors.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. These sites serve as a public gallery for the data stolen during a breach, acting as a tool for psychological warfare against the targeted entity. When a group lists an organization, it serves as a public notification of the breach, often accompanied by proof of the intrusion to validate their claims.

Details of the leaked information

The images shared on the leak site include samples of tables and documents that appear to relate to the organization's operational processes; however, there is no detailed information regarding the full scope and nature of the data. The listing names no specific data types or quantities of files.

In many modern cyberattacks, threat actors employ a method known as double extortion. In this scenario, the attackers do not just encrypt the victim's systems to disrupt business operations; they also exfiltrate sensitive information before the encryption occurs. The threat of leaking this stolen data on a public forum provides the attackers with additional leverage during ransom negotiations, as the victim faces the threat of public exposure and regulatory scrutiny.

About Noi Hotels

Noi Hotels is a luxury hotel chain based in Chile. It provides boutique hotel services in various regions of Chile.

Risk assessment and industry implications

This incident may bring about the risk of exposure for customer and employee data within Noi Hotels. Given the Qilin group's double-extortion method, it is considered that the organization's operational continuity could be disrupted and the leaked data could be utilized for secondary attacks. The group has been known to be active since 2022 and targets various sectors.

As an organization based in Chile, legal consequences may arise regarding compliance with local data protection regulations. Furthermore, the sensitivity of personal data in the hospitality sector may increase risks such as identity theft and targeted phishing attacks. The nature of the hospitality industry, which handles significant amounts of personal and financial information, makes it a high-value target for various threat actors.

To mitigate such risks, organizations in the hospitality sector typically focus on strengthening their defensive posture through several key areas. Implementing robust multi-factor authentication (MFA) across all remote access points can prevent unauthorized entry. Regular security awareness training for employees can help defend against phishing, which is often the initial vector for ransomware deployment. Additionally, maintaining strict network segmentation can limit the ability of an attacker to move laterally through the network to reach sensitive data stores. Finally, ensuring comprehensive logging and monitoring allows for faster detection of anomalous behavior, potentially stopping a breach before data exfiltration occurs.