Stormous ransomware group lists www.regencytorviscas.com on its leak site

• Ransomware group: Stormous
• Country: Spain
• Sector: Hospitality
• Announcement date: May 11, 2025

Stormous claims data leak of Regency Torviscas

The Stormous ransomware group has announced a significant data leak involving Regency Torviscas. According to an announcement made on the group's leak site on May 11, 2025, the threat actors claim to have exfiltrated approximately 17 GB of data belonging to the organization. This announcement follows a claimed attack date of May 11, 2025, indicating that the breach and the subsequent leak were reported simultaneously.

The group asserts that they successfully gained unauthorized access to the institution's internal systems. By breaching the network, the attackers claim to have obtained a variety of sensitive files. This type of activity is characteristic of modern ransomware operations, where attackers often employ double extortion tactics. In such scenarios, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage, threatening to publish it on a public leak site if a ransom demand is not met.

Details of the alleged data breach

The information released by the Stormous group suggests a wide-ranging compromise of the organization's digital assets. The leaked content is reported to include highly sensitive information that could impact both the company and its clientele. Based on the group's claims, the stolen data encompasses a variety of formats and types, ranging from administrative credentials to personal identification documents.

The specific types of data allegedly stolen include:

• Customer reservation records
• Identity documents
• Email lists
• RDP credentials

The group claims that the stolen datasets include full customer reservation databases, which contain names, phone numbers, email addresses, physical addresses, and booking dates. Furthermore, the breach allegedly involves scanned identity documents, such as passports and national ID cards. The attackers also claim to have accessed internal communications via OWA, as well as employee and customer email lists. Additionally, the group claims to have obtained RDP credential files, which are highly sensitive as they provide direct access to remote desktop services.

About Regency Torviscas

Regency Torviscas is an apartment hotel and holiday resort located in Tenerife, Spain. The facility provides accommodation and holiday services to its guests, operating within the hospitality sector. Given its location and service model, the organization manages a significant amount of personal information related to travelers and tourists.

Risk assessment and industry implications

This alleged leak poses substantial risks to the customers of Regency Torviscas. The availability of full reservation databases and scanned identity documents, such as passports and national IDs, creates a high risk for identity theft. Furthermore, the presence of email lists and internal communications increases the likelihood of targeted phishing attacks, where attackers use stolen details to craft convincing fraudulent messages to deceive individuals or employees.

From a technical security perspective, the theft of RDP credentials is particularly concerning. These credentials could be used to compromise the institution's network security and facilitate secondary attacks, allowing attackers to move laterally through the network or maintain persistent access.

As the institution operates in Spain, it may be subject to legal obligations regarding data protection under the General Data Protection Regulation (GDPR). Such breaches often trigger mandatory notification requirements to regulatory authorities and affected individuals. This incident may have negative implications for the institution's operational continuity and its overall reputation within the hospitality industry.

For organizations operating in the hospitality sector, which handle vast amounts of personal and financial data, maintaining robust security postures is essential. Common defensive steps include implementing multi-factor authentication (MFA) to protect remote access points like RDP, maintaining strict network segmentation to prevent lateral movement, and conducting regular security awareness training to mitigate the risk of phishing. Additionally, organizations often employ continuous monitoring and endpoint detection and response (EDR) tools to identify unauthorized access attempts before data exfiltration can occur.

• Note: No ransom demand was specified in the announcement.