Bern Hotels & Resorts Listed by Akira Ransomware Group

Bern Hotels & Resorts was listed on the Akira ransomware group's leak site on December 03, 2023. The Panama-based hotel chain, one of the country's largest, is claimed to have had internal files exfiltrated during a ransomware attack. The listing states that a dozen GB of operational files containing detailed personal information will be released soon and specifically invites comments about interest in passport and payment information. Anyone who has stayed at or worked for the group may have their data at risk.

Reported Details from the Listing

The Akira leak site posting, preserved via ransomware.live, states that Bern Hotels & Resorts suffered a ransomware intrusion. It states that internal files were exfiltrated and that roughly 12 GB of operational data containing personal information is held for potential publication. The disclosure does not quantify how many individuals are affected, nor does it list every data type beyond referencing passports and payment details in the comment prompt. No ransom amount or negotiation status appears in the public listing.

Why This Matters for You and Your Family

When a hotel group loses control of guest and employee records, the exposure reaches far beyond the company. If you have ever provided identification, credit card details, or contact information during a stay or booking in Panama, those records may now sit in an attacker-controlled archive. The disclosure indicates that passport and payment information are among the files, which can be used for identity theft, fraudulent bookings, or account takeovers long after the initial breach. Families who travel together often share the same booking references, multiplying the number of people whose full personal profiles are now at risk.

Doxxing and Identity-Chain Risks

Hotel records frequently link real names, home addresses, phone numbers, email accounts, and passport numbers. Once attackers publish even a sample of these files, other criminals can combine them with data from earlier breaches to build complete identity chains. A single leaked email can lead to gaming accounts, loyalty programs, or financial services. Credential leaks of this kind routinely cascade into account takeovers because people reuse passwords across travel, banking, and entertainment platforms. Children’s information tied to family bookings can also surface, exposing younger users to long-term doxxing risks on social media and gaming networks.

Akira Group's Known Track Record

Public reporting attributes the Akira ransomware operation to a group that emerged in 2023. The actors have targeted organizations across multiple sectors with a double-extortion playbook: they encrypt victim systems and simultaneously exfiltrate data before demanding payment to prevent publication. Notable prior victims include manufacturing, healthcare, and hospitality companies. Akira typically gains initial access through compromised remote desktop credentials or exploited vulnerabilities, then moves laterally to locate sensitive files. Their leak site is used both to pressure victims and to invite third parties to bid on stolen data when negotiations fail.

What to do

• Run a DoxxScan to map every link between your email, phone, passport number, and real-world identity so you can see exactly what chains back to this claimed breach.
• Rotate any password you used when booking or checking in at Bern Hotels & Resorts and enable 2FA with an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught within hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts which often chain back to the same addresses and emails.
• Let remediation specialists handle data-broker takedown requests and follow-up monitoring for you instead of attempting manual removal across dozens of sites.

The incident shows how quickly travel-related data can fuel broader identity crimes. A single hotel breach can quietly feed months of targeted fraud and doxxing attempts against you and your family. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage including children’s gaming accounts give ordinary people the same defensive capabilities once reserved for large organizations. Start your DoxxScan trial today to understand and reduce your exposure before the next leak appears.