Tengu ransomware group lists skyegtours.com on its leak site

• Ransomware group: Tengu
• Country: United Kingdom
• Sector: Hospitality
• Announcement date: January 27, 2026

Tengu ransomware group claims data breach at skyegtours.com

The threat actor known as Tengu has officially listed the hospitality company skyegtours.com on its ransomware leak site. In an announcement made on January 27, 2026, the group claimed to have successfully gained unauthorized access to the organization's internal files, marking a potential significant data exposure for the United Kingdom-based firm.

According to the claims made by the Tengu group, they have obtained access to various internal datasets belonging to the company. The group alleges that they attempted to establish communication with the management of skyegtours.com to resolve the situation, but they claim they have not received any response from the organization. This lack of communication is a common theme in ransomware extortion scenarios, where attackers often use leak sites to pressure victims into paying a ransom by threatening to release sensitive information publicly.

Details of the alleged data exposure

The announcement suggests that the breach may involve a wide range of sensitive materials. Based on the information provided by the threat actor, the exposure could include critical operational and project-related documents that are essential to the company's daily functions. The group has provided a screenshot that appears to show various directory structures, which may indicate the depth of their access. These directories include folders labeled 'API', 'Data', 'Invoices 2023', and 'Office', alongside various application and document files.

The specific types of data identified as being potentially affected include:

• Financial records
• Corporate operational documents
• API data

While the group has claimed access to these files, the total volume of data and the specific count of files involved have not been disclosed by the attackers. Furthermore, no specific ransom demand has been made public in the current announcement.

About skyegtours.com

Sky Egypt is a tourism company that offers travel packages and flight ticket services to various destinations. It provides travel planning services with an emphasis on customer satisfaction, catering to both budget-friendly and premium travel preferences.

Potential impact and organizational implications

This incident may lead to the exposure of the company's customer and operational data, which could negatively impact the organization's commercial reputation. Because the company is based in the United Kingdom, the incident may fall under the scope of UK GDPR, potentially triggering mandatory data breach notification requirements. If the leaked data includes customer financial information or personal data, secondary risks such as identity theft and targeted phishing attacks may emerge.

In the context of modern cyber threats, this incident follows the pattern of double extortion, a tactic where ransomware groups not only encrypt a victim's systems but also steal sensitive data to use as leverage for extortion. By threatening to leak the data on a public site, attackers increase the pressure on the victim to comply with their demands to prevent reputational damage and regulatory fines.

Information regarding the Tengu group remains limited, and their specific methods and motivations remain uncertain. For organizations in the hospitality sector, such incidents highlight the importance of robust cybersecurity frameworks. It may be advisable for the organization to initiate a forensic investigation to determine the full scope of the potential data exposure. Defensive measures typically include implementing strict access controls, maintaining offline backups, and conducting regular vulnerability assessments to mitigate the risk of unauthorized access to sensitive directories like API and financial records.