Stormous ransomware group lists www.holidaypalace.com on its leak site

• Ransomware group: Stormous
• Country: Cambodia
• Sector: Hospitality
• Announcement date: December 8, 2025

The Stormous ransomware group has announced that it has successfully compromised the systems of Holiday Palace. According to a post made on a leak site, the threat actor claims to have exfiltrated sensitive information belonging to the organization and is currently offering the stolen data for sale on the dark web.

The alleged breach and claims by Stormous

On December 8, 2025, the threat actor known as Stormous announced that it had gained unauthorized access to the internal systems of holidaypalace.com. The group alleges that the intrusion allowed them to extract significant amounts of information from the institution's databases, specifically targeting user information and booking records. According to the group's announcement, the data is currently being offered for sale to the highest bidder.

It is important to note that while the group has made these claims, no screenshots or additional evidence were provided to verify the contents of the stolen database. In many modern ransomware attacks, groups employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's files to demand a ransom for decryption; they also steal sensitive data to threaten the victim with public exposure or sale on leak sites if the ransom is not paid. This tactic is designed to maximize pressure on the target organization by threatening its reputation and legal standing.

Details of the alleged data exposure

The information claimed to be stolen by Stormous is highly sensitive, encompassing a wide range of personally identifiable information (PII) and financial details. The group alleges that the breach includes the following types of data:

• User email addresses
• Phone numbers
• Full names
• Dates of birth
• Payment data
• Booking information
• ID card copies
• Passport copies

The inclusion of identity documents, such as copies of passports and ID cards, significantly elevates the severity of the alleged leak. Such documents are highly prized by cybercriminals for fraudulent activities and identity theft.

About Holiday Palace

Holiday Palace is a hotel and casino complex located in Poipet, Cambodia. Situated on the border with Thailand, the facility provides accommodation services alongside various gambling and casino offerings.

Risk assessment and industry implications

This incident, if verified, may significantly increase the risk of identity theft and fraud for the customers of the institution. The alleged exposure of highly sensitive documents, such as passports and identification cards, could be utilized by malicious actors for secondary attacks or highly targeted phishing campaigns. Such campaigns often use specific personal details to build trust with the victim, making the deception much harder to detect.

Furthermore, the alleged leak could trigger legal processes under the data protection regulations applicable in the region where the organization operates. Given the Stormous group's history of politically motivated activities, the leak could be intended as a tool to damage the institution's reputation. The accuracy and scope of the data have not yet been verified by independent sources.

For organizations operating in the hospitality and gambling sectors, which handle vast amounts of sensitive customer data, maintaining robust cybersecurity defenses is critical. Common defensive steps include implementing multi-factor authentication (MFA), maintaining strict access controls, and ensuring regular, encrypted backups of all critical databases. Additionally, organizations often employ continuous monitoring and threat detection systems to identify unauthorized access attempts before data exfiltration can occur. Protecting customer identity documents requires specialized attention to data encryption and secure storage protocols to mitigate the impact of a potential breach.