Country Inn & Suites by Radisson Listed by everest Ransomware Group

On October 19, 2024, the Everest ransomware group listed Country Inn & Suites by Radisson on its leak site, claiming the hotel chain suffered a ransomware attack in which internal files were exfiltrated. The listing states that thousands of clients’ personal information, credit card details, internal emails, incident reports, messages, and a full calendar of past and future bookings were taken. It also alleges the company stored passwords insecurely and that management knew about the breach yet took no action. The disclosure does not specify the exact number of affected individuals.

Reported Details from the Listing

The Everest leak site posting, accessible via the ransomware.live mirror, asserts that the attackers exfiltrated internal files during a ransomware incident. According to the disclosure, the data includes client personal information, credit card info, internal emails, incident logs, messages, and a complete booking calendar. The group claims the hotel operator demonstrated “complete negligence” in how passwords and private data were stored. The listing gives the company a deadline to resolve the matter with the attackers before their published timer expires. No independent confirmation of the record count or exact data volume has been provided by the company in any public filing reviewed to date.

Why This Matters for You and Your Family

If you have stayed at a Country Inn & Suites location in recent years, your name, contact details, payment information, and booking history may now sit in a ransomware actor’s hands. Credit card data combined with booking calendars can reveal travel patterns, home addresses, and family member names. Internal emails and incident reports sometimes contain additional notes about guests that were never meant to leave the company’s systems. For ordinary travelers and families, this translates into immediate risk of fraud, identity theft, and unwanted targeting. The breach is not abstract; it directly touches anyone whose reservation records were stored by the hotel chain.

Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at dumping raw files. Once personal records appear on a leak site, other criminals scrape the data and begin linking it across platforms. An email address from a hotel booking can be matched to accounts on social media, loyalty programs, or gaming services. A phone number tied to a past reservation can surface in people-search databases. These connections create an identity chain that lets attackers impersonate you, reset passwords elsewhere, or harass family members. Credential leaks like this one frequently cascade into account takeovers, especially for gaming accounts belonging to children that reuse the same email or password. The longer the data circulates unchecked, the harder it becomes to contain the downstream damage.

Everest Ransomware Group Track Record

Public reporting attributes the Everest ransomware operation to a group that first appeared in 2021. The actors are known for double-extortion tactics: they encrypt victim systems and simultaneously threaten to publish stolen data unless a ransom is paid. Notable prior victims have included healthcare providers, manufacturers, and hospitality companies. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files before encryption. The group maintains a leak site to pressure victims publicly and often escalates by contacting employees or customers directly. While exact ties to other ransomware families remain subject to ongoing analysis, Everest consistently follows the model of stealing data first and then using the threat of release as leverage.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, booking details, and real-world identity so you can see exactly what chains exist from this claimed breach.
• Rotate any password you used when booking at Country Inn & Suites or on related Radisson sites, and enable 2FA with an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught and acted on in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become targets when credential leaks like this one surface.
• Let DoxxScan remediation specialists handle takedown requests for any exposed personal records found circulating on data-broker and underground sites.

The incident underscores that even routine hotel reservations can feed long-term identity risks once a ransomware group decides to publish. Acting quickly on the exposed data trails gives you the best chance of limiting what criminals can build from it. Start your DoxxScan trial and put continuous monitoring, identity-chain mapping, and specialist remediation to work for your entire family. Its hands-on approach has been built precisely for breaches like this one.