vect ransomware group lists guesty, LITELLM/TRIVY CAMPAIGN (TEAMPCP) on its leak site

• Ransomware group: vect
• Country: Israel
• Sector: Technology
• Announcement date: April 15, 2026

A massive data breach claimed against Guesty

The technology company Guesty has been listed on a leak site by the threat actor group vect, alleging a significant data breach. The announcement, which appeared on April 15, 2026, marks a potential security incident for the organization. While the claim has been made publicly by the threat actor, the details of the breach remain allegations until verified.

The threat actor vect claims to have exfiltrated 700 GB of data belonging to Guesty. According to the announcement, the breach is extensive and involves various critical components of the company's operations. The group alleges that the compromised information includes internal projects, the user base, and data related to third-party platforms such as Airbnb and Booking.com. Furthermore, the threat actor claims that the breach includes approximately 4 million emails containing attachments.

Details of the alleged leaked data

The information allegedly stolen by the group is quite diverse, spanning from internal corporate documents to sensitive user information and communication logs. Although the threat actor has made these claims, it is important to note that no screenshot was provided to substantiate the contents of the stolen data. The alleged leaked data includes:

• Internal project files
• User data
• Airbnb and Booking.com platform data
• Email correspondence and attachments

The scale of the alleged theft, particularly the claim regarding millions of emails with attachments, suggests a highly targeted or highly expansive exfiltration process. In modern cyberattacks, such large volumes of data are often used in double extortion tactics, where attackers not only encrypt systems but also threaten to release sensitive information to pressure the victim into paying a ransom.

About Guesty

Guesty is a technology company that provides end-to-end property management software and automation solutions for short-term rental businesses. It integrates with platforms like Airbnb and Booking.com to assist property owners with reservation, communication, and operational management processes. Given its role in the technology sector, the company serves as a vital link in the ecosystem of short-term rental management.

Risk assessment and industry implications

Public information regarding the group vect is limited, making it difficult to assess their specific tactics, techniques, and procedures. If the breach claim is verified, Guesty users may face significant risks, including identity theft and targeted phishing attacks. The nature of the data involved, which includes user information and correspondence, makes it a high-value target for subsequent malicious activities.

Given the sector and the nature of the data involved, administrative sanctions under GDPR and local data protection regulations could be observed if the breach is confirmed. The fact that the alleged data involves third-party platforms may introduce supply chain risks and double extortion scenarios. In a supply chain attack, a breach at one service provider can have cascading effects on the partners and clients that rely on that provider's integration.

As the negotiation process is reported to be ongoing, the likelihood of data publication may depend on the effectiveness of current security measures and the outcome of any discussions between the victim and the threat actor. For organizations in this sector, maintaining robust security postures, implementing strong encryption, and ensuring rigorous third-party risk management are essential defensive steps to mitigate the impact of such potential incidents.