Qilin ransomware group claims data breach against sbh

• Ransomware group: Qilin
• Country: Spain
• Sector: Hospitality
• Announcement date: June 24, 2025

Qilin group claims data breach at sbh

The Qilin ransomware group has officially listed sbh on one of its leak sites, claiming that a data breach has occurred against the organization. According to the announcement, the post was published on June 24, 2025. This development marks a significant escalation in the threat landscape facing the hospitality sector, as the group has moved to publicize its claims regarding the targeted entity.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. These sites are used to announce successful intrusions and to shame organizations into paying ransoms by threatening to release sensitive information. The presence of a company on such a site is a serious indicator of a potential security compromise, though the claims made by these groups are often used as a tactic in broader extortion campaigns.

Details of the alleged attack

The claim made by the Qilin group suggests that the organization has been targeted in a cyberattack. The announcement was made on June 24, 2025, coinciding with the claimed attack date. While the group has taken the step of listing the organization publicly, the specific details surrounding the breach remain limited. At this stage, the group has not provided information regarding the total size of the data allegedly stolen or the specific number of files involved in the incident. Furthermore, there has been no mention of a specific ransom demand in the public announcement.

Regarding the nature of the information taken, the current assessment is limited. The content of the leaked data cannot be clearly determined because the screenshot provided by the group is blurry. Consequently, the listing names no specific data types that have been compromised. Without clear visibility into the leaked files, it is difficult to ascertain the exact scope of the information at risk.

Organizational profile

The target of this alleged attack is sbh, also known as SBH Hotels & Resorts. This organization is a hotel chain that has been operating for over 30 years. Their operations span several locations, including Fuerteventura, Lanzarote, and Zanzibar. The company provides a variety of services to its guests, including accommodation, gastronomy, and various holiday-related services.

Implications and industry risks

This claim may indicate that data from a company operating in the hospitality sector has been leaked. Such an event could pose significant risks to the privacy of customer and employee data. In the hospitality industry, organizations handle a vast amount of sensitive information, ranging from personal identification to financial details, making them attractive targets for cybercriminals.

The group's use of double extortion tactics could create additional pressure on the organization. Double extortion is a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This dual-threat approach increases the leverage held by the attackers, as the organization faces both operational downtime and the threat of reputational damage and legal consequences.

Data breach allegations may lead to legal proceedings under data protection regulations such as GDPR. Organizations must navigate complex regulatory landscapes when personal data is compromised. Additionally, secondary risks may include targeted phishing attacks or identity theft, as stolen information can be used to impersonate individuals or conduct further fraudulent activities. To mitigate these risks, organizations in this sector often focus on strengthening their defensive posture through robust encryption, multi-factor authentication, and continuous monitoring of their networks to detect unauthorized access early.