RansomEXX ransomware group lists Go2Joy (go2joy.vn) on its leak site

• Ransomware group: RansomEXX
• Country: Vietnam
• Sector: Hospitality
• Announcement date: June 20, 2026

RansomEXX claims data breach against Go2Joy

The RansomEXX ransomware group has listed the Vietnamese hospitality platform Go2Joy on its leak site. According to the announcement made on June 20, 2026, the group claims to have successfully exfiltrated a significant amount of data from the organization's systems. This announcement follows a claimed attack date of June 20, 2026.

The group's announcement involves the release of archives that they claim contain a vast amount of sensitive information. Specifically, the RansomEXX group states that the leaked archives include 1,398,693 customer records and 13,289 staff entries. While the group has published this information on their leak site, public information regarding the specific identity and operational details of the RansomEXX group remains limited.

Details of the alleged data exposure

The data allegedly stolen during this incident is extensive and covers various aspects of both customer and internal operations. Based on the claims made by the threat actor, the exposed information includes a wide range of personally identifiable information (PII) and sensitive corporate details. The breach appears to target both the consumer-facing side of the platform and the internal administrative structures.

The specific types of data mentioned in the claim include:

• Customer contact information
• Customer booking history
• Staff HR data
• Financial emails

More granular details regarding the content of the leak include customer names, email addresses, mobile contacts, physical addresses, and birthdates. Furthermore, the claim includes technical and loyalty-related data such as device fingerprints and loyalty balances. The breach also reportedly involves booking histories, staff names, role permissions, direct and finance emails, and SMS routing preferences.

About Go2Joy

Go2Joy is a digital platform based in Vietnam that specializes in the hospitality sector. The service focuses on providing hourly and short-stay hotel bookings. Through its mobile application service, the platform allows users to quickly find and reserve affordable accommodation options.

Impact and security implications

The sensitivity of the allegedly leaked data carries significant risks for all parties involved. For the users of the platform, the exposure of names, contact details, and birthdates may increase the risk of identity theft and targeted phishing attacks. Such attacks often leverage stolen personal information to trick individuals into revealing further credentials or financial details.

For the organization, the exposure of staff data could compromise internal operational security and potentially facilitate secondary attacks against the company or its employees. The use of double extortion—a tactic where attackers both encrypt data and threaten to leak it—can lead to significant reputational damage and a loss of customer trust. Additionally, the organization may face legal processes under the data protection regulations in Vietnam.

In general, when organizations face such threats, common defensive steps include implementing robust multi-factor authentication, maintaining regular offline backups, and conducting thorough employee security awareness training. Monitoring for unauthorized data exfiltration and maintaining strict access controls are also vital components of a modern cybersecurity posture to mitigate the impact of such incidents.