Ransomware group BYOD hits First and Final Warning - IHG Hotels & Resorts (Estate)

MEDIUM

·Hospitality·2026-11-05

First and Final Warning - IHG Hotels & Resorts (Estate) — a hospitality target has been listed by the BYOD ransomware group on 2026-11-05. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.

Incident Report

Target Organization	First and Final Warning - IHG Hotels & Resorts (Estate)
Threat Group	BYOD
Summary	First and Final Warning - IHG Hotels & Resorts (Estate), a hospitality organization, was listed by the BYOD ransomware group on its leak site on 2026-11-05.
Date of Breach	2026-11-05
Discovery Date	2026-11-05
Region	—
Target Domain	—
Business Sector	Hospitality
Severity	MEDIUM

Claim by BYOD

Here are some sample files for you and the public to see. Let's actually resolve this situation before we have to escalate it in ways we don't want to have to do. Make the right choice, we're not going to warn you again. | ORIGINAL MESSAGE: Nice LDAP Binding Password being '123'. Rotating things won't really save you casue it's not hard to hop back on your network. Anyways, we now have; Customer Data, AWS Keys, Full Access to CyberArk, Complete Employee PII, Booking information included but not limited to, guest name, billing address, company, rate code, room charges, taxes, spend, property & stay dates. We also have the loyalty data store. Additionally we have reservation and payment ledgers for the folio reservation (guest name, address, phone, email, arrival and departure, rate, property) with Access to the AD + All Financial Records. This affects the big names such as Six Senses, Holiday Inn, Holiday Inn Express, Staybridge Suites, Garner, Candlewood, Crowne Plaza, Mayfair Hotel, etc etc you can pick up what we are putting down at this point. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.

Posted by the BYOD threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.

Disclaimer

HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.