RansomHub ransomware group lists www.avalon-hotel.com on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Hospitality
• Announcement date: February 25, 2025

RansomHub claims to have exfiltrated data from Avalon Hotel

The ransomware group known as RansomHub has listed Avalon Hotel on its leak site, claiming to have successfully compromised the organization's data. According to the announcement made on February 25, 2025, the threat actor alleges that they have exfiltrated a significant volume of information from the entity.

The group asserts that the total volume of the data stolen during the attack is 58 GB. To support their claims of a successful breach, the threat actors have provided screenshots of file directories that purportedly belong to the internal operations of the organization. These images are intended to serve as evidence of the unauthorized access and the subsequent theft of corporate information.

Details of the alleged data theft

The contents of the leaked screenshots suggest that the stolen information is highly sensitive, consisting of various financial and administrative documents. The data appears to touch upon the core administrative and fiscal functions of the business. The specific types of information identified in the leak include:

• Payroll records
• Tip logs
• Bank reports
• Accounts payable
• W-9 tax forms

The presence of such documentation indicates that the breach may have impacted the privacy of both the organization's internal staff and its external business partners. When ransomware groups engage in such activities, they often utilize a strategy known as double extortion. In this model, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. The threat of leaking private information is used to pressure the victim into paying a ransom to prevent the public release of the data.

About Avalon Hotel

Avalon Hotel is a hospitality establishment located in Erie, Pennsylvania, USA. The hotel provides lodging and event services to its guests. As a business operating within the hospitality sector, the organization manages a variety of sensitive information related to guest services, employee management, and financial transactions.

Potential impact and security considerations

The alleged exfiltration of data containing financial and administrative records carries significant risks. For the individuals whose information was potentially compromised, such as employees and business partners, there is an increased risk of identity theft and fraud. Furthermore, because the organization is based in the United States, this incident may lead to legal consequences under state-level data protection laws and relevant regulations.

The organization may also face risks related to reputational damage and operational disruptions. Additionally, considering the historical tactics of the RansomHub group, it is possible that the leaked data could be utilized for secondary attacks or targeted phishing campaigns against the organization or the individuals involved. RansomHub is a group with limited public information; it is reported that the group emerged in early 2024 and ceased operations in early 2025.

In general, organizations in the hospitality sector can mitigate such risks by implementing robust cybersecurity frameworks. This includes maintaining strict access controls, ensuring comprehensive encryption for data at rest and in transit, and conducting regular security awareness training for employees to prevent phishing. Maintaining offline, immutable backups is also a critical defensive step to ensure operational continuity in the event of a ransomware attack.