Stormous group claims data leak involving crystalhotels.com.tr

• Ransomware group: Stormous
• Country: Türkiye
• Sector: Hospitality
• Announcement date: May 21, 2025

The Stormous ransomware group has announced the listing of data allegedly belonging to the Turkish hospitality organization crystalhotels.com.tr. According to the group's announcement on their leak site, the breach involves a significant volume of information, with the group claiming that approximately 40 GB of data has been compromised.

The details of the alleged attack

The claim was made public on May 21, 2025. The Stormous group is a known threat actor that typically employs a strategy of combining data theft with ransom demands. This group has also been identified as being politically motivated in its operations. In the announcement, the group provided a screenshot that includes a sample file, identified as Sample.zip, to support their claims regarding the stolen information.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on victims. By publishing stolen data, these groups aim to damage the reputation of the target or force the organization to pay a ransom to prevent further exposure. The group's methodology often involves a process known as double extortion. In a double extortion scenario, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data and threaten to release it publicly if the ransom is not met. This adds a layer of pressure, as the organization faces the threat of regulatory penalties and loss of customer trust even if they can restore their systems from backups.

The types of data claimed to be leaked

While the total volume of the alleged leak is cited at 40 GB, the specific contents of the data set include several categories of sensitive information. The group claims to have accessed and leaked the following types of data:

• Full names of hotel guests
• Email addresses (internal and external)
• Customer complaints and feedback content
• Booking or reference numbers
• Internal hotel communication data

The presence of such diverse data types, ranging from guest identifiers to internal communications, suggests a broad access to the organization's information systems during the alleged incident.

Implications and risks for the sector

The alleged leak of this information carries several significant risks. For the organization, the exposure of guest names, email addresses, and booking details could lead to targeted phishing attacks against the hotel's customers. These attackers may use the stolen information to craft highly convincing fraudulent communications, potentially leading to further identity theft or financial fraud for the guests involved.

Furthermore, the exposure of internal communication data and customer feedback can cause substantial reputational damage to the company. From a regulatory perspective, such a breach may trigger formal data breach processes under KVKK regulations, which govern data protection and privacy in Türkiye. The combination of data theft and ransom demands used by Stormous increases the overall risk profile for the organization, as they must manage both the technical recovery from an attack and the legal and communicative challenges of a public data exposure.

In the hospitality sector, maintaining the confidentiality of guest information is a critical component of business operations. Organizations in this industry often face high risks due to the volume of personal and sensitive data they process daily. To mitigate the risks associated with such threats, industry professionals generally focus on robust defensive measures. These include implementing multi-factor authentication, maintaining strict access controls to sensitive databases, and conducting regular security awareness training for staff to prevent initial access through phishing. Additionally, maintaining comprehensive logging and monitoring can help in the early detection of unauthorized data exfiltration, which is a key component of a modern cybersecurity posture.