The Seacare Hotel listed on lamashtu ransomware leak site

• Ransomware group: lamashtu
• Country: Singapore
• Sector: Hospitality
• Announcement date: April 13, 2026

Lamashtu claims data breach at The Seacare Hotel

The Seacare Hotel, a hospitality organization based in Singapore, has been listed on the leak site of the ransomware group known as lamashtu. According to the announcement made on April 13, 2026, the threat actor claims to have successfully exfiltrated a significant volume of sensitive information belonging to the hotel.

The threat actor known as lamashtu claims to have exfiltrated a dataset consisting of 60 GB of data and 50,000 files belonging to The Seacare Hotel. The announcement specifies that the leaked materials include operational and financial documents spanning from 2023 to early 2026. The group is attempting to exert pressure on the organization by publishing these findings on their leak site.

Details of the claimed data exfiltration

The data allegedly stolen by the attackers is quite extensive, covering several years of business operations. The group claims that the stolen information includes a wide variety of sensitive documents that could impact the organization's internal operations and its relationships with external partners. The leaked data includes:

• Employee HR data
• Financial records
• Corporate contracts
• System credentials

The specific contents of the files reportedly include employee personnel files, contracts with corporate clients and travel agencies, and financial reports such as balance sheets and profit and loss statements. Furthermore, the leaked information encompasses employee-related documents covering claims and benefits, as well as system credentials.

About The Seacare Hotel

The Seacare Hotel is a hotel located in Singapore, known for its proximity to major tourist attractions such as Orchard Road and Chinatown. The property offers accommodation services along with amenities including a gym and a Sky lounge.

Analysis and potential impact of the breach

This breach may pose secondary risks such as identity theft and targeted phishing attacks for the organization's employees and customers. Under Singapore's Personal Data Protection Act (PDPA), the organization may face data breach notification obligations and potential administrative penalties. The exposure of financial data and system credentials could weaken the organization's operational security in the long term and potentially facilitate supply chain attacks.

Information about this group is limited; however, the typical methods of ransomware actors suggest that the publication of this data may negatively impact the organization's reputation and business relationships. Ransomware groups often employ a strategy known as double extortion, where they not only encrypt an organization's data but also steal it, threatening to leak it on a public site to increase pressure for ransom payments. By publishing the data, the attackers aim to cause maximum reputational and operational damage.

In the hospitality sector, such incidents can be particularly damaging due to the high volume of personal and financial data processed daily. Organizations in this sector typically focus on robust data encryption, strict access controls, and comprehensive employee training to mitigate these risks. While the specific details regarding the group's methods remain limited, the potential for identity theft and targeted phishing remains a significant concern following the exposure of personnel and system credentials.