Rhactushotel.com listed on Lockbit5 leak site

• Ransomware group: Lockbit5
• Country: Egypt
• Sector: Hospitality
• Announcement date: May 7, 2026

The Egypt-based accommodation provider rhactushotel.com has been listed on the leak site of the Lockbit5 ransomware group. The threat actor group claims to have successfully compromised the organization's data and has issued a public ultimatum regarding the situation.

The claims made by Lockbit5

According to the announcement posted on the group's leak site, the Lockbit5 ransomware group claims to have breached rhactushotel.com. The group has specified a deadline for the organization, stating that they have until May 22, 2026, to meet certain requirements. The threat actors have suggested that if their demands are not met by this stated deadline, they may proceed to publish the allegedly stolen data online.

This type of tactic is a hallmark of modern ransomware operations. By setting a public countdown or a specific deadline, threat actors exert psychological pressure on the victim organization. This pressure is intended to force a quick decision, often bypassing the time required for a thorough forensic investigation or a coordinated legal and technical response.

Details regarding the alleged data breach

Regarding the specifics of the incident, the announcement provided no details or sample files regarding the content of the allegedly compromised data. No information was provided concerning the total size of the data or the specific number of files involved in the breach. Furthermore, the group has not disclosed any specific ransom demands or the exact date the initial attack occurred, though the listing was announced on May 7, 2026.

The listing names no specific data types that have been compromised.

Organization profile

Rhactus Hotel is an accommodation service provider operating in El-Alamein, Egypt. The organization offers various hospitality and lodging services to its guests, serving as a key provider within the regional hospitality and lodging sector.

Analysis and industry implications

The Lockbit group is a known entity that has been operating since 2019. They utilize a Ransomware-as-a-Service (RaaS) model, which allows different affiliates to carry out attacks using the group's infrastructure and tools. Given the group's history, it is possible that a double extortion strategy is being employed through both data encryption and exfiltration.

Double extortion is a sophisticated method where attackers do not just encrypt an organization's files to disrupt operations, but also steal sensitive data beforehand. This provides the attackers with additional leverage; even if the organization can restore its systems from backups, the threat actors can still demand payment by threatening to leak the stolen information to the public.

The potential publication of the organization's data may lead to the exposure of guest personal information and increase the risk of identity theft. If employee data is included in the breach, it may create vulnerabilities for internal security and facilitate targeted phishing attacks. Furthermore, the organization could face legal repercussions under Egyptian data protection regulations.

For organizations operating in the hospitality sector, such incidents highlight the critical importance of robust data protection frameworks. Organizations in this sector can take several defensive steps to mitigate such risks, including implementing strict access controls, maintaining offline backups, and conducting regular security awareness training for employees to prevent initial access via phishing. Additionally, monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection laws are essential components of a modern cybersecurity posture.