Stormous ransomware group lists www.regencyrestors.com on its leak site

• Ransomware group: Stormous
• Country: United States
• Sector: Hospitality
• Announcement date: May 11, 2025

Stormous claims data leak against Regency Restors

The threat actor known as Stormous has listed data on its leak site, claiming it belongs to the organization Regency Restors. This announcement, made on May 11, 2025, indicates a potential data breach involving the hospitality and vacation rental service provider. The group claims to have obtained access to various internal files and databases belonging to the company.

According to the claims made by the threat actor, the breach involves a significant amount of sensitive information. The group asserts that they have successfully accessed the organization's reservation databases and identity documents. Furthermore, the group's announcement includes a screenshot that appears to show a directory listing format, which suggests the presence of numerous files within the compromised environment.

Details of the claimed stolen data

The information allegedly exfiltrated by the Stormous group is quite diverse, covering both customer-related and internal corporate data. The group claims to have obtained full customer reservation databases, which could contain sensitive booking details. Additionally, the leak is said to include scanned identity documents, specifically mentioning passports and national IDs.

Beyond identity documents and reservation details, the threat actor claims to have accessed internal communications and credentials. The specific items listed in the claim include:

• Customer reservation data
• Identity documents
• Email addresses
• RDP credentials

The claim also mentions the presence of internal emails via OWA and lists containing both employee and customer email addresses. While the group has posted these claims on their leak site, no specific information was provided regarding the total size of the data or the specific number of files involved. Furthermore, no ransom demand has been specified in the current announcement.

About Regency Restors

Regency Restors is a hospitality and vacation rental service provider based in the United States. The company offers short-term accommodation solutions in various locations, serving travelers and guests seeking diverse lodging options.

Analysis and potential implications

This alleged leak may pose secondary risks such as identity theft and targeted phishing attacks for the organization's customers and employees. The exposure of RDP credentials is particularly concerning, as it could suggest that the organization's network security might be vulnerable to broader breaches. When credentials for Remote Desktop Protocol are exposed, it often provides an entry point for further unauthorized access to a network.

Given that the organization is based in the United States, legal processes under state-level data protection laws and sectoral regulations may be triggered as a result of this incident. Organizations in the hospitality sector often handle high volumes of Personal Identifiable Information (PII), making them frequent targets for cybercriminals seeking to monetize sensitive data.

The Stormous group, which has been active since 2021 and claims to be driven by political motivations, may employ methods that combine data leaks with ransom demands. This is a common tactic in modern ransomware operations, often referred to as double extortion, where attackers not only encrypt data but also threaten to publish it to pressure the victim into paying.

To address such incidents, organizations typically need to initiate a forensic investigation to verify the actual scope of the leaked data and determine the exact method of entry. General defensive steps for organizations facing these threats include strengthening identity and access management, implementing multi-factor authentication, and maintaining rigorous monitoring of remote access points to prevent unauthorized entry.