Stormous ransomware group lists www.axxoshotels.com on its leak site

• Ransomware group: Stormous
• Country: Germany
• Sector: Hospitality
• Announcement date: May 21, 2025

Stormous claims data breach at Axxos Hotels

The threat actor known as Stormous has listed the hospitality provider www.axxoshotels.com on its leak site. According to the announcement made on May 21, 2025, the group claims to have stolen and leaked 33 GB of data belonging to the organization. To support these claims, the group provided a 9.5 MB sample file as evidence of the alleged breach.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not only encrypt an organization's systems to demand a ransom for decryption but also steal sensitive information to threaten its public release. By hosting stolen data on dedicated leak sites, these groups exert maximum pressure on victims to meet their demands, often using the threat of reputational damage and regulatory scrutiny as leverage.

Details of the alleged data leak

The claims made by Stormous suggest that the compromised information is significant in scope and sensitivity. The group alleges that the stolen data includes various types of information that could be highly sensitive for both the organization and its clients. Specifically, the leaked data is claimed to contain:

• Customer data
• Identity cards
• Booking records

The group specifically mentions that the information includes 2025 booking records, customer information, and images of identity cards. The presence of identity card images is particularly concerning, as such documents are highly valued by cybercriminals for fraudulent activities.

About Axxos Hotels

Axxos Hotels is a Germany-based hospitality and accommodation services provider. The company operates hotel management activities in various locations, serving the needs of travelers and guests through its various hospitality and accommodation services.

Potential impact and industry implications

This incident carries several significant risks and implications for the affected organization. Because Axxos Hotels is based in Germany, this incident may lead to data protection violations under the General Data Protection Regulation (GDPR). Such regulatory breaches can result in substantial investigations and legal consequences for the entity involved.

The exposure of identity cards poses a direct threat to the individuals whose data was stolen. The release of such sensitive identification documents could increase the risk of identity theft and fraud for the affected individuals. Furthermore, the leaked data could be utilized for secondary attacks or targeted phishing campaigns, where attackers use stolen personal details to gain the trust of victims in subsequent social engineering attempts.

Given the politically motivated nature of the Stormous group, this incident may result in significant reputational damage for the organization. For companies in the hospitality sector, maintaining guest trust is paramount, and a high-profile leak of personal identification and booking details can severely undermine that trust.

In the wake of such incidents, organizations are often required to fulfill data breach notification obligations and inform the affected customers. To defend against such threats, organizations typically focus on robust security measures, such as implementing multi-factor authentication, maintaining strict access controls, and conducting regular security audits. Monitoring for unauthorized data exfiltration and ensuring comprehensive encryption for sensitive data at rest and in transit are also standard defensive practices used to mitigate the impact of potential breaches.