Costa Del Sol Hotels Listed by sarcoma Ransomware Group

On October 9, 2024, Costa Del Sol Hotels, a Kuwaiti hospitality company operating two premier hotels and a rural estate since the 1980s, appeared on the leak site of the sarcoma ransomware group. The listing claims the attackers exfiltrated 50.5 GB of internal files during a ransomware incident. The company has not yet issued a public breach notification detailing the exact data involved or the number of people affected.

Details from the Leak Listing

The sarcoma leak site states that Costa Del Sol Group suffered a ransomware attack in which internal files were taken. It lists the data volume as 50.5 GB in an archive containing files, though it does not specify which systems were compromised or the precise categories of information exposed. The disclosure indicates the company is based in Kuwait and manages hospitality properties. No ransom demand figure or negotiation status is shown on the listing, and the exact deadline for any extortion payment remains unknown.

Public reporting on sarcoma confirms the group routinely publishes samples or full datasets when victims do not pay. The primary source does not quantify how many customer records, employee records, or vendor documents may be inside the archive.

Why This Matters for You and Your Family

If you have stayed at either of the Costa Del Sol hotels, dined at their restaurants, or attended events at the rural estate, your personal information could be among the stolen files. Hotels routinely collect names, home addresses, phone numbers, email addresses, passport or national ID copies, payment card details, and booking histories. When such data leaves the company’s control, it can be used for identity theft, fraudulent bookings, or targeted phishing campaigns against you and your family.

Even a single leaked reservation record can give criminals enough detail to impersonate you with banks, airlines, or government agencies. Families are especially exposed because one parent’s booking often includes children’s names, dates of birth, and travel documents.

The Doxxing and Identity-Chain Risks

Hotel breach data rarely stays isolated. Criminals combine leaked reservation files with other exposures to build detailed profiles. An email address from this incident can be matched to gaming accounts, social-media handles, or school records, creating long identity chains that lead to doxxing. Children’s information included in family bookings is particularly dangerous because gaming usernames and parental email addresses can be hijacked to harass or extort minors directly.

Once criminals link your hotel stay data to other breaches, they can launch convincing spear-phishing attacks that reference specific trips, room numbers, or dining preferences. These attacks succeed far more often than generic spam and can result in financial loss or further data theft.

Sarcoma Ransomware Group Track Record

Public reporting attributes sarcoma to a relatively new ransomware operation that began active campaigns in 2024. The group follows a double-extortion model: it first encrypts victim systems and then threatens to publish stolen data if the ransom is not paid. Notable prior victims listed on the same leak site include other mid-sized companies across Europe and the Middle East. sarcoma typically gains initial access through phishing or exploited remote desktop services, exfiltrates data quietly, then deploys ransomware and waits for payment. When victims refuse to pay, the group releases samples and eventually the full archive on its leak site, as appears to be happening with Costa Del Sol Hotels.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, hotel booking details, and real-world identity so you can see the full exposure picture.
• Rotate any password you used when booking with Costa Del Sol Hotels or on any site sharing the same email address, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and acted on within hours.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails used for hotel reservations.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal documents or photos that surface on data-broker or extortion sites.

The sarcoma listing of Costa Del Sol Hotels shows how quickly hospitality data can move from a corporate server to public extortion pages. Acting promptly on the exposure can limit how far criminals take the information. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from credential leaks like this one.