crystalhotels.com.tr Listed by stormous Ransomware Group

On May 21, 2025, the ransomware group Stormous added crystalhotels.com.tr to its leak site, exposing internal files that include full names of hotel guests, email addresses, customer complaints, booking numbers, and internal hotel communications.

Reported Details from Reporting

Public reporting indicates the Turkish hotel chain suffered a ransomware attack in which attackers exfiltrated internal documents before posting a sample on their onion site. The exposed data includes both internal and external email addresses, the content of guest complaints and feedback, booking or reference numbers, and records of staff communications. The exact number of affected guests remains unknown, though the files clearly contain personal information belonging to individuals who stayed at the hotels. No ransom payment deadline has been publicly confirmed in available reporting.

Why This Matters for You and Your Family

When you book a hotel room, you expect your name, email, and booking details to remain private. A breach like this means that information may now be in the hands of criminals who can sell it or use it to target you. Full names paired with emails and booking records make it easier for scammers to craft convincing phishing emails that reference your actual travel history. Children’s information sometimes appears in family bookings, which can pull younger family members into identity-related risks earlier than expected. Once your data leaves a company’s control, you and your family carry the long-term consequences.

The Doxxing and Identity-Chain Risks

Names, emails, and booking numbers rarely stay isolated. Attackers combine them with other leaked records to build detailed profiles. A hotel complaint that mentions your child’s name or a family member’s phone number can link gaming accounts, social profiles, and home addresses. These connections create doxxing chains that lead to harassment, targeted scams, or account takeovers. Credential leaks of this type frequently cascade into gaming platforms, where stolen email-password pairs let intruders hijack accounts belonging to you or your children. The speed at which these chains form leaves little time for manual defense.

Stormous Group Track Record

Public reporting attributes Stormous with emerging in late 2020. The group has targeted hospitals, schools, retailers, and hospitality companies. Its typical playbook involves gaining initial access, exfiltrating sensitive files, then publishing samples on leak sites to pressure victims into payment. When victims refuse, Stormous releases larger portions of the stolen data. Available reporting describes their extortion style as opportunistic, often hitting mid-sized organizations that lack robust public incident response.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate any password you used on crystalhotels.com.tr anywhere else it appears, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts tied to the same contact details.
• Let remediation specialists manage takedown requests for any exposed personal records that surface on data broker sites.

The incident shows that travel data you once considered routine can quickly become part of larger identity chains. Acting quickly on the exposed information gives you and your family the best chance of limiting damage. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of information that criminals already possess.