CDSHotels Listed by rhysida Ransomware Group

On April 26, 2024, hospitality provider CDSHotels appeared on the leak site operated by the Rhysida ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The company, which describes itself as a leader in the hospitality industry for thirty years, has not publicly quantified how many customer or employee records may be affected.

Details in the Leak-Site Listing

The Rhysida leak page indicates that internal files were taken. It does not specify the volume of data, the exact types of records, or whether customer booking details, payment information, or staff personnel files are included. The disclosure follows the group’s standard pattern of posting a sample of stolen material and threatening full publication unless a ransom is paid. No deadline is shown in the current listing, and CDSHotels has not issued a formal breach notification that is visible in public regulator filings at the time of writing.

Why This Matters for You and Your Family

When a hotel chain’s internal systems are compromised, the information that travels with a booking often includes names, home addresses, phone numbers, email addresses, and sometimes dates of birth or payment card details. If you or your family have stayed at any CDSHotels property in recent years, your personal data may now sit in an attacker-controlled archive. Even without exact record counts, the exposure creates immediate risks of phishing, identity theft, and unwanted contact that can affect every member of a household.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently contain more than isolated records. They can link guest profiles to loyalty accounts, reservation notes, and employee contact lists, forming chains that connect an email address to a physical address, phone number, and even children’s names listed on family bookings. Attackers and subsequent data resellers can combine this information with other breaches to build detailed dossiers. These dossiers are then used for targeted scams, account takeovers, or public doxxing. Credential leaks of this nature also cascade into gaming platforms where family members reuse email addresses or passwords, exposing children’s accounts to hijacking and further harassment.

Rhysida’s Known Track Record

Public reporting attributes the first activity of Rhysida to May 2023. The group has since listed dozens of organizations across healthcare, education, and hospitality sectors. Notable prior victims include the British Library and several U.S. healthcare providers. Rhysida typically gains initial access through vulnerable remote desktop services or phishing, exfiltrates data before deploying ransomware, and then runs a double-extortion campaign: demanding payment to prevent both encryption and data publication. The group’s leak site presents samples and countdown timers, a playbook consistent with the CDSHotels listing.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you used on CDSHotels websites or reservation portals anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and leak forums on your behalf while you focus on securing your own accounts.

The incident underscores that even mid-sized hospitality companies remain attractive targets and that your data can surface on ransomware sites without warning. A single breach like this can feed months of follow-on attacks unless you actively break the identity chains it creates. Start your DoxxScan trial and put continuous monitoring plus hands-on remediation to work for your entire family, including gaming accounts that are frequently overlooked.