Praveg Caves Jawai listed on medusalocker ransomware leak site

• Ransomware group: medusalocker
• Country: India
• Sector: Hospitality
• Announcement date: September 12, 2026

Medusalocker claims data breach at Praveg Caves Jawai

The medusalocker ransomware group has officially listed the Indian hospitality business Praveg Caves Jawai on its leak site. According to the announcement made on September 12, 2026, the threat actor claims to have gained access to sensitive information belonging to the organization. This development follows a pattern common in modern cyberattacks where threat actors utilize dedicated leak sites to pressure victims by threatening to release stolen data.

This type of activity is often associated with double extortion tactics. In such scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also exfiltrate sensitive data to use as leverage. By threatening to publish this information on a public platform, the group aims to maximize the pressure on the target to meet their demands. While the listing has been posted, the specific details regarding the ransom demand and the total volume of data stolen remain unknown.

Details of the claimed incident

The claim made by the medusalocker group suggests that the breach involves critical operational details. The threat actor has indicated that the leaked information includes technical details regarding the hotel management and point-of-sale (POS) systems utilized by the institution. Furthermore, the group has noted that staff names are among the information involved in the breach.

Despite these claims, the available evidence is limited. The screenshot provided by the threat actor only displays the general verification page of the leak site. Consequently, there is no visual evidence or direct documentation provided to confirm the actual content of the leaked data. At this stage, there is no clear information regarding the full scope of the data involved beyond the specific technical and personnel details mentioned by the group.

Organization profile

Praveg Caves Jawai is a luxury safari resort located in the Rajasthan state of India. The facility operates near the Jawai leopard reserve and offers a variety of services to its guests. These services include accommodation, the organization of safari tours, and on-site dining at the Panthera restaurant and bar.

Implications and industry observations

This incident highlights how digital infrastructures within the hospitality sector can serve as significant targets for ransomware groups. The disclosure of technical information regarding hotel management software, such as Property Management Systems (PMS) or Point of Sale (POS) systems, suggests that vulnerabilities within these specific operational technologies may have been exploited to facilitate the attack.

The potential consequences of such a breach are multifaceted. For the organization, the leakage of operational information or customer data can lead to significant reputational damage. Additionally, the exposure of sensitive information can create secondary risks for customers, such as the potential for identity theft. Furthermore, the organization may face legal obligations and regulatory scrutiny under the data protection laws applicable in India.

To defend against such threats, organizations in the hospitality sector generally focus on securing their digital perimeters. This includes implementing robust access controls, maintaining regular software updates to patch vulnerabilities in management systems, and conducting regular security assessments. As information regarding the medusalocker group remains limited, the incident serves as a reminder of the evolving risks faced by service-oriented businesses in a digital economy.