Grupo DIRIA Listed by dragonforce Ransomware Group

On August 27, 2025, the ransomware group DragonForce added Grupo Diria to its leak site, confirming that it had exfiltrated internal files from the Costa Rican luxury accommodation provider after the company apparently did not meet the attackers’ demands.

Confirmed Facts from Reporting

Public reporting indicates that DragonForce claims to have stolen internal documents from Grupo Diria, a hospitality company that operates hotels and resorts in Tamarindo Beach, Costa Rica. The listing appeared on the group’s leak site on August 27, 2025. No specific count of affected customer records has been published, and the precise volume or types of files remain unclear from available screenshots and summaries. The data is described only as “internal files” exfiltrated during a ransomware incident.

Grupo Diria serves travelers seeking upscale lodging and cultural experiences. Its guest database, booking records, vendor contracts, and employee information are therefore likely to contain personal details such as names, addresses, phone numbers, email addresses, passport copies, and payment information.

Why This Matters for You and Your Family

When a hospitality company loses control of guest records, the people who stayed there become exposed. If you or your family have ever booked a room, honeymoon, or family vacation at a Grupo Diria property, your contact details and travel documents may now sit in an attacker’s archive. That information can be sold quietly or used to launch targeted scams that sound legitimate because they reference real booking dates or room numbers.

Even if you were not a direct guest, family members who travel frequently or use shared email addresses for reservations can still be affected. One leaked record is often enough to start a chain of identity theft that reaches children, spouses, or household accounts.

The Doxxing and Identity-Chain Risk

Ransomware leaks rarely stop at one company. Attackers frequently cross-reference stolen guest lists with other breach data to build detailed profiles. A phone number from a hotel booking can link to your social-media handles, children’s gaming usernames, or school-related accounts. Once those connections are mapped, harassers or identity thieves can impersonate you, reset passwords across services, or publish personal information online.

Credential leaks like this one cascade into account takeovers and doxxing chains, especially when the same password or email has been reused for years. Gaming accounts belonging to children are particularly vulnerable because they often share family email addresses and lack strong authentication.

DragonForce’s Publicly Known Track Record

Public reporting attributes DragonForce with emerging in late 2023 as a ransomware operation that combines double-extortion tactics with data leaks. The group has listed victims ranging from small businesses to regional service providers. Its typical playbook involves gaining initial access through phishing or exploited remote-desktop services, exfiltrating documents before encryption, then pressuring victims with countdown timers and sample data dumps on its leak site. When payment is not received, DragonForce publishes portions of the stolen files to demonstrate seriousness and encourage future targets to pay.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, travel accounts, and real-world identity so you can see exactly what chains back to this breach.
• Rotate any password you used when booking at Grupo Diria or similar hospitality sites, then enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often share the same contact details.
• Let remediation specialists handle takedown requests for any personal records that surface on data-broker or doxxing sites.

The incident shows that even companies focused on hospitality and guest comfort can lose control of the personal information they collect. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with a single leaked booking record. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4 billion breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.