casa-andina.com Listed by lockbit3 Ransomware Group

On August 29, 2023, Peruvian hotel chain Casa Andina appeared on the LockBit 3.0 ransomware leak site, claiming that internal files had been exfiltrated during a ransomware attack. The listing, hosted on the group’s .onion portal and mirrored on ransomware.live, states that the company’s data is now publicly available for anyone to download. Anyone who has stayed at a Casa Andina property, used their booking portal, or shared personal details with the chain may have information now circulating in criminal channels.

Reported Details from the Listing

The LockBit 3.0 leak page explicitly names casa-andina.com and describes the incident as a successful ransomware deployment in which internal files were allegedly exfiltrated. It does not publish the total number of records affected, nor does it list specific data types such as guest names, passport scans, payment card details, or employee payroll files. The disclosure indicates only that the stolen archive is now hosted for free download by other criminals. No ransom demand figure or negotiation timeline is shown on the public page, which is typical once LockBit moves to full public exposure.

Why This Matters for You and Your Family

When a hotel chain loses control of internal files, the exposure often includes booking records, loyalty program accounts, contact details, and sometimes copies of identification documents provided during check-in. If your information is inside that archive, it can be used for identity theft, fraudulent reservations, or targeted phishing campaigns that reference real past stays. Travel-related breaches are especially dangerous because they frequently contain home addresses, phone numbers, and email accounts tied to family members who traveled together. Even if you cannot confirm whether your data was taken, the uncertainty itself creates lasting risk.

The Doxxing and Identity-Chain Implications

Stolen hotel records rarely stay isolated. A single email address or phone number from a booking can be cross-referenced with credential-stuffing databases, social-media handles, and public records to build a complete identity profile. Criminals then use these chains to hijack linked accounts, including gaming profiles that share the same password or recovery email. Children’s accounts are frequently targeted once a parent’s details surface, because gaming platforms often lack strong verification and serve as entry points for further harassment or financial fraud. The leak therefore represents not just a privacy incident but the starting point of a potential long-term doxxing campaign against you and your household.

LockBit 3.0’s Publicly Known Track Record

Public reporting attributes the LockBit ransomware family’s first appearance to January 2020. The group rebranded as LockBit 3.0 in early 2023 after law-enforcement actions against earlier versions. It has claimed responsibility for attacks on hundreds of organizations worldwide, including healthcare providers, manufacturers, and hospitality companies. The typical playbook begins with initial access gained through compromised remote desktop credentials or phishing, followed by rapid lateral movement, data exfiltration, and deployment of the ransomware payload. LockBit operators then wait a short period before publishing samples on their leak site if the victim does not pay. The group’s leak pages are designed for maximum visibility, often including screenshots and direct download links, which accelerates secondary exploitation by other threat actors.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you used on casa-andina.com or related booking sites wherever it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts sharing the same address or recovery details.
• Let remediation specialists manage takedown requests for any exposed personal documents that appear on data-broker or extortion sites.

The Casa Andina listing is a reminder that travel companies remain attractive targets because their databases hold intimate details about where families sleep, eat, and spend time. One breach can cascade into account takeovers and harassment that last for years. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage including children’s gaming accounts give ordinary families a practical way to detect and reduce these expanding risks before criminals exploit them. Start your DoxxScan trial today to understand exactly what is already exposed and begin closing those doors.