Stormous ransomware group claims data breach at nirvanahotels.com.tr

• Ransomware group: Stormous
• Country: Türkiye
• Sector: Hospitality
• Announcement date: May 21, 2025

Stormous group claims data theft from nirvanahotels.com.tr

The Stormous ransomware group has listed approximately 40GB of data on their leak site, which they claim belongs to nirvanahotels.com.tr. This announcement was made on May 21, 2025, marking a significant claim against the Turkish hospitality provider.

According to the announcement published by the group, the attack is claimed to have occurred on May 21, 2025. The group alleges that they successfully obtained approximately 40GB of data from the organization's systems. However, it is important to note that the screenshot provided by the group does not contain evidence of the content and displays only an error page, meaning the content of the alleged leak has not been verified.

Alleged data types and content

While the group's provided screenshot does not verify the content, the claims regarding the stolen information suggest a wide range of sensitive data. The group alleges that the data obtained includes various types of information related to both guests and internal operations. The specific items mentioned in the claim include:

• Full names of hotel guests
• Internal and external email addresses
• Customer complaints and feedback content
• Booking or reference numbers
• Internal hotel communication data

The presence of such data in a leak scenario often points toward the tactics used by modern ransomware actors. These groups frequently employ double extortion, a method where they not only encrypt an organization's systems to disrupt operations but also threaten to leak sensitive data to pressure the victim into paying a ransom. By threatening to release customer information, attackers aim to maximize the leverage they hold over the target organization.

Organization profile

Nirvana Hotels is a luxury hotel chain operating in the Antalya region of Turkey. It provides high-end vacation and accommodation services to its guests.

Analysis and potential impact

The claims were made by the Stormous group, an entity that has been active since 2021 and claims to be driven by political motivation. The potential exposure of this data carries significant implications for both the organization and its clientele. If the data is indeed leaked, legal processes may be triggered for the organization due to the necessity of protecting personal data under regulations such as the KVKK.

Beyond the legal ramifications, the exposure of this data may create secondary risks for guests. These risks include identity theft and targeted phishing attacks, as attackers can use specific details like booking numbers and complaint history to craft highly convincing fraudulent communications. Furthermore, such a breach is expected to negatively impact the organization's operational processes and customer trust.

In the hospitality sector, maintaining the integrity of guest information is critical for business continuity and reputation management. When organizations face such threats, common defensive strategies often involve implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication across all systems, and maintaining rigorous monitoring of network traffic to detect unauthorized data exfiltration. Additionally, regular security awareness training for staff can help mitigate the risk of initial access through phishing, which is a common entry vector for ransomware groups.