Es Saadi Listed by Meow Ransomware Group

On November 5, 2023, the ransomware group known as meow added Es Saadi to its leak site, declaring that 100% of the stolen data had been leaked. The hospitality company, which operates hotels, casinos, and entertainment venues in Marrakech, Morocco, is the latest victim in a string of attacks where the group exfiltrates internal files before encrypting systems and then publicly pressures victims by posting samples or full archives.

Details from the Leak Site

The meow leak site listing states that Es Saadi suffered a ransomware attack in which internal files were exfiltrated. The disclosure indicates the data was fully published after the company apparently did not meet the group's demands. The listing does not quantify the number of affected records, name specific systems compromised, or list exact data types beyond the broad description of internal files. Public views of the onion site, archived through ransomware.live, state the November 5, 2023 publication date and the claim that the entire stolen dataset was released.

Why This Matters for You and Your Family

When a company like Es Saadi loses control of internal files, the information often includes customer records, booking details, payment information, employee payroll data, and vendor contracts. If your family has stayed at any of their properties, dined at their restaurants, or attended events there, your personal details may now sit in an archive freely available on dark-web forums. This exposure creates immediate risks of identity theft, fraudulent bookings made in your name, or targeted phishing emails that reference real past transactions. For families, the breach can also affect children if family bookings or loyalty accounts were stored in the compromised files.

The Doxxing and Identity-Chain Risks

Internal files from hospitality firms frequently contain full names, home addresses, phone numbers, email addresses, dates of birth, and sometimes passport or national ID copies. Once published, these records become building blocks for doxxing chains. Attackers link your hotel booking email to gaming accounts, social-media handles, or reused passwords found in other breaches. The result can be full identity exposure, including physical addresses published on harassment forums or SIM-swapping attempts that target family members. Credential leaks of this kind routinely cascade into account takeovers on gaming platforms, where children's accounts become entry points for further harassment or extortion.

Meow Ransomware Group's Track Record

Public reporting attributes the meow group with emerging in early 2023 as a relatively new ransomware operation that favors speed and public shaming over prolonged negotiation. The group has listed dozens of victims across sectors including manufacturing, healthcare, and hospitality. Their typical playbook involves initial access through compromised remote desktop credentials or phishing, followed by rapid exfiltration of documents, then deployment of ransomware. When victims do not pay, meow publishes the data quickly on their leak site and moves on, a pattern seen in multiple prior incidents where the group posted gigabytes of corporate files within days of the initial breach announcement.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have been exposed in the Es Saadi files.
• Rotate any password you used for Es Saadi bookings or loyalty accounts anywhere it has been reused, and switch to 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children's gaming accounts, which often chain back to the same addresses or parent emails leaked in hospitality breaches.
• Let DoxxScan remediation specialists handle takedown requests for any exposed personal documents or broker listings that appear after this leak.

The Es Saadi breach is a reminder that even a single compromised booking can feed long-term identity abuse if not addressed quickly. Start your DoxxScan trial today and gain both immediate visibility into your exposure and hands-on help from specialists who continuously monitor dark-web sources and broker sites. Their AI-powered identity-chain mapping and household coverage give your family protection that scales from your email to your children's online accounts.