Watermark Beach Resort listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Canada
• Sector: Hospitality
• Announcement date: December 13, 2025

Qilin ransomware group claims data exfiltration from Watermark Beach Resort

The Qilin ransomware group has listed Watermark Beach Resort on their leak site, claiming to have exfiltrated data from the organization. This announcement, made on December 13, 2025, marks a potential significant security incident for the Canadian hospitality provider.

Details of the claimed attack

The threat actor known as Qilin listed Watermark Beach Resort on its leak platform on December 13, 2025. The group claims to have gained access to the organization's network and obtained data. This listing is considered part of the group's double extortion strategy.

Double extortion is a common tactic used by modern ransomware groups. In this method, attackers do not simply encrypt a victim's files to disrupt operations; they also steal sensitive information before the encryption process begins. The attackers then threaten to leak this stolen data on public forums or leak sites if the ransom is not paid. This approach increases the pressure on the victim, as the threat of public exposure of sensitive information can cause significant reputational and legal damage, even if the organization can recover its systems from backups.

Information regarding the exfiltrated data

There is no specific information regarding the nature or content of the allegedly exfiltrated data in the announcement; the provided screenshot does not contain sufficient detail to verify the nature of the data. The listing names no specific data types or file counts.

About Watermark Beach Resort

Watermark Beach Resort is a resort located on the shores of Osoyoos Lake in British Columbia, Canada. The property provides luxury accommodations, event spaces, and various vacation services to its guests.

Risk assessment and implications

This incident suggests a potential risk of exposure for customer and employee data held by Watermark Beach Resort. Given the Qilin group's double extortion method, it is possible that the exfiltrated data could be utilized in identity theft or targeted phishing attacks. The group has been active since 2022 and is known to target various sectors; this may create pressure on the organization's operational continuity.

For organizations operating in Canada, data breach notification obligations under PIPEDA may arise. Such regulations often require companies to notify individuals and relevant authorities when a breach poses a real risk of significant harm. In the hospitality sector, where organizations handle large volumes of personal information for bookings and guest services, maintaining robust cybersecurity measures is critical to protecting sensitive customer details.

To defend against such threats, organizations typically focus on multi-layered security strategies. This includes implementing strong access controls, such as multi-factor authentication, to prevent unauthorized network access. Regular monitoring of network traffic can help detect unusual activity that might indicate a breach in progress. Furthermore, maintaining offline, encrypted backups is a fundamental step in ensuring operational continuity in the event of a ransomware attack. Organizations in the hospitality sector must remain vigilant against the evolving tactics used by groups like Qilin, which have demonstrated the ability to target diverse industries to maximize their extortion leverage.