Fun For Less Tours Listed by anubis Ransomware Group

On December 1, 2025, the Anubis ransomware group added Fun For Less Tours to its leak site and began publishing what it claims are the company’s internal files, including customer passports and personal data.

What's Publicly Reported from Reporting

Public reporting indicates that Fun For Less Tours, a travel company specializing in group tours, suffered a ransomware intrusion. The attackers exfiltrated internal documents before encrypting systems or otherwise disrupting operations. The data set includes scanned passports, names, addresses, contact details, and other personal information belonging to customers who booked tours.

Exact victim counts remain undisclosed. The Anubis leak page, hosted on an onion domain and tracked by ransomware.live, lists the incident with a sample of the stolen files. No ransom demand deadline has been publicly confirmed in available reporting, though ransomware groups routinely set short windows before releasing more data.

Why This Matters for You and Your Family

When a travel company loses passport scans and customer records, the exposure goes far beyond a single vacation. That information gives criminals the exact documents needed to open accounts, apply for credit, or impersonate you at government agencies. If you or anyone in your family has traveled with Fun For Less Tours, your full name, date of birth, passport number, and home address may now sit in criminal hands.

Passport data is especially dangerous because it is difficult to change and is accepted as primary identification worldwide. A single leak can fuel years of fraud, account takeovers, and targeted scams against you and your children.

The Doxxing and Identity-Chain Implications

Stolen travel records rarely stay isolated. Criminals combine passport details with email addresses, phone numbers, and usernames found in other breaches to build complete identity chains. One exposed email leads to linked social-media accounts; a phone number reveals family connections; a home address ties everything to your physical location.

These chains accelerate doxxing. Once attackers map your online handles to your real identity, they can harass you directly, target your children’s gaming accounts that use the same email, or sell the full profile on dark-web markets. Credential leaks of this type routinely cascade into account takeovers across banking, email, and gaming platforms.

Anubis Ransomware Group Track Record

Public reporting attributes the attack to the Anubis ransomware group. The group emerged in early 2024 and has since claimed responsibility for dozens of intrusions against mid-sized businesses. Notable prior victims include healthcare providers, logistics firms, and other travel-related companies.

Anubis typically gains initial access through phishing or exploited remote desktop services, exfiltrates sensitive files, then deploys ransomware. Its standard playbook involves publishing samples on a leak site and threatening full data release unless payment is made. The group’s extortion style combines data leaks with occasional distributed denial-of-service pressure.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains exist right now.
• Rotate any password you used when booking with Fun For Less Tours and enable 2FA with an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and exposed records while you focus on securing your own accounts.

The incident shows how quickly travel data can become fuel for larger identity crimes. Taking concrete steps now limits the damage and reduces the chance that this claimed breach becomes the first link in a prolonged campaign against you or your family. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.