guesty, LITELLM/TRIVY CAMPAIGN (TEAMPCP) Listed by Vect Ransomware Group

On April 15, 2026, the ransomware group Vect added Guesty to its leak site, claiming that it had exfiltrated roughly 700GB of internal files from the property management platform. The data includes internal projects, approximately 4 million sent and received emails with attachments, userbase records, and information tied to Airbnb and Booking.com listings. The company’s status on the leak site reads “NEGOTIATING,” with a public deadline of 9 days and 8 hours from the posting.

What Public Reporting Shows

Public reporting indicates the breach stems from a ransomware attack on Guesty, a service used by property managers and vacation rental hosts to handle bookings, guest communications, and payments. The exposed volume — 700GB — contains a mix of operational files and customer-related information. Available reporting describes the stolen material as including internal projects, millions of emails and their attachments, userbase details, and data linked to major short-term rental platforms.

The incident is attributed to the Vect ransomware operation. At the time of publication the group had not publicly dumped the files, but listed Guesty under the campaign name “LITELLM/TRIVY CAMPAIGN (TEAMPCP).” No confirmed victim count has been released, leaving many hosts and guests uncertain whether their specific records are included.

Why This Matters for You and Your Family

If you have ever used a vacation rental service, booked through Airbnb or Booking.com, or stayed at a property managed by Guesty, your personal information may now sit inside the stolen 700GB archive. Names, email addresses, phone numbers, booking histories, payment details, and guest messages could be exposed. For families this often means children’s names and travel dates are included as well.

Once such data leaves a company’s control, it rarely stays contained. It can be sold quietly on underground forums or used to launch targeted attacks against you months or years later. The breach therefore affects not only the property managers but every individual whose information passed through Guesty’s systems.

The Doxxing and Identity-Chain Implications

Ransomware groups like Vect rarely stop at the initial theft. They understand that one leaked email or phone number can be chained to dozens of other accounts. A booking confirmation that lists your home address, child’s name, and gaming username creates a direct path for doxxing. Credential leaks of this kind frequently cascade into account takeovers on gaming platforms, social media, and email services.

Identity-chain mapping becomes critical here. Attackers link your rental booking handle to your real identity, then scan for every other service that uses the same password or recovery phone number. Children’s gaming accounts are especially vulnerable because parents often reuse credentials across family devices and services.

Vect Ransomware Group’s Track Record

Public reporting attributes Vect to a relatively new ransomware-as-a-service operation that emerged in late 2024. The group is known for targeting mid-sized businesses in the hospitality, property management, and professional services sectors. Notable prior victims include several European hotel chains and North American SaaS providers, according to trackers on ransomware.live.

Vect’s typical playbook begins with initial access gained through phishing or exploitation of remote desktop services, followed by rapid exfiltration of sensitive files. The group then encrypts systems and posts samples on its leak site while opening ransom negotiations. Extortion pressure combines public shaming with threats to release customer data if payment is not made before the deadline.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate the password you used on any Guesty-linked accounts or services where it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own logins.

The Guesty breach is a reminder that data stolen today can fuel identity theft and harassment campaigns long after the ransom deadline passes. Protecting yourself and your family requires more than changing a few passwords. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered online handles to real identities, and hands-on remediation by specialists who manage takedowns on your behalf. Its household coverage also protects children’s gaming accounts that frequently become the next link in a doxxing chain. Starting early gives you the best chance of staying ahead of attackers who already hold 700GB of someone else’s trust.