emresorts.com Listed by lockbit5 Ransomware Group

On December 25, 2025, the ransomware group LockBit5 added emresorts.com to its leak site, claiming that internal files had been exfiltrated from the Greek luxury resort operator during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates the incident involves EM Resorts, which operates two flagship properties in Crete. The data stolen consists of internal files; the exact volume and full list of contents remain undisclosed. No confirmed victim count has been published, leaving uncertainty about how many customers, employees, or partners may be affected. The leak site posting carries the typical LockBit structure, showing samples of the allegedly stolen material and a countdown for further publication or auction.

December 25, 2025 marks the public disclosure date on the LockBit5 leak site. The attack itself occurred earlier, following the group’s standard pattern of initial access, encryption, and subsequent data exfiltration when ransom demands are not met.

Why This Matters for You and Your Family

When a hospitality company’s internal files are stolen, the information often includes guest records, booking details, payment information, and contact data. If you or your family have stayed at EM Resorts or used their services, some of your personal information may now sit on a criminal leak site. Even a single exposed email, phone number, or passport scan can serve as the starting point for identity theft, phishing campaigns, or more targeted scams.

Internal files exfiltrated means the breach is not limited to a simple list of passwords. It can contain contracts, employee records, vendor agreements, and customer communications that reveal far more than most people realize about daily lives and travel habits.

The Doxxing and Identity-Chain Implications

Stolen hospitality data frequently links real names and addresses to email accounts, phone numbers, and sometimes social-media handles used during booking or check-in. Criminals can chain these fragments together to build a complete profile. A seemingly harmless booking confirmation can expose your home address, children’s names, or travel patterns that are later used for doxxing, stalking, or social-engineering attacks.

Credential leaks of this nature also cascade into gaming accounts. Many families use the same email address for hotel bookings and for children’s Roblox, Fortnite, or Steam accounts. Once that email appears in a leak, attackers can attempt password resets across every service tied to it, turning one resort breach into widespread account takeovers.

LockBit5’s Publicly Known Track Record

Public reporting attributes LockBit5 as the latest iteration of the LockBit ransomware operation. The group first emerged in 2019 and has repeatedly rebranded after law-enforcement actions. It has targeted hospitals, schools, manufacturers, and hospitality providers worldwide. Its typical playbook involves gaining initial access through phishing or exploited remote-desktop services, deploying ransomware to encrypt systems, exfiltrating sensitive files before encryption, then demanding payment while threatening to publish or auction the data on its leak site. When victims refuse to pay, LockBit5 posts samples and sets deadlines, often giving victims 7 to 14 days before full data release.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the included cleanup of data-broker listings tied to this claimed breach.
• Rotate any password you used at emresorts.com or any related EM Resorts site, and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same emails and addresses used for travel bookings.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you, removing exposed personal information before it spreads further.

The incident shows that even a single vacation booking can feed a larger criminal ecosystem that thrives on chained identities. Taking deliberate steps now limits how far this claimed breach can reach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting your DoxxScan trial gives you and your family the clearest view of what has already leaked and the fastest path to closing those doors.