Hotel Avenida, Hostal Espoz y Mina, Hostal Arriazu, Pension Alemana Listed by trigona Ransomware Group

On February 28, 2024, the Trigona ransomware group listed Hotel Avenida, Hostal Espoz y Mina, Hostal Arriazu, and Pension Alemana on its leak site, claiming that internal files had been exfiltrated from the Boutique Hospitality Collection properties in Lisbon and Pamplona.

Details in the Leak-Site Listing

The primary disclosure on the Trigona leak site states that the four hospitality businesses suffered a ransomware attack in which attackers successfully exfiltrated internal files. The listing does not quantify the number of affected guest records, nor does it specify the exact data types contained in the stolen files. It simply states that data was taken and is now held for extortion purposes. The disclosure indicates the incident falls under the group’s standard double-extortion model: encryption of systems followed by threats to publish or sell the stolen information if ransom is not paid.

February 28, 2024 marks the public appearance of this listing. No prior breach notification from the companies themselves has surfaced, leaving the precise timeline of initial compromise and volume of records unknown to the public.

Why This Matters for You and Your Family

When you book a room at a boutique hotel or hostel, you routinely hand over your full name, home address, phone number, email address, date of birth, and payment-card details. If those records were inside the internal files taken in this attack, your personal information may now be in the hands of criminals. The same applies to every member of your family whose details were used for a reservation. Even a single leaked booking can give attackers the starting point they need to build a profile that reaches far beyond the hotel stay itself.

Internal files exfiltrated in a ransomware incident often contain more than just guest databases. Employee payroll records, vendor contracts, and scanned identification documents frequently sit on the same servers. Any of these can be used to commit identity theft, file fraudulent tax returns, or open accounts in your name.

The Doxxing and Identity-Chain Risk

A hotel booking is rarely an isolated data point. It often links your real name and address to the email address and phone number you used to confirm the reservation. Those same credentials are frequently reused on airline sites, loyalty programs, and family email accounts. Once attackers possess even a modest set of those links, they can chain them with information from other breaches to create a detailed dossier. Children’s names listed on family bookings can also surface, exposing younger family members to long-term risks including doxxing on gaming platforms where the same email or phone may be registered.

Credential leaks of this nature regularly cascade into account takeovers. An attacker who obtains your booking email and a reused password can seize control of connected services, then use the additional data found there to refine their profile and escalate the extortion.

Trigona’s Publicly Known Track Record

Public reporting attributes the first appearances of Trigona to mid-2022. The group has since targeted organizations across Europe and North America, with a focus on mid-sized businesses in hospitality, manufacturing, and professional services. Notable prior victims include other hotel operators and tourism-related companies, though exact prior record counts remain unconfirmed in open sources. Their typical playbook begins with phishing or exploitation of remote-desktop services for initial access, followed by rapid lateral movement, data exfiltration, and deployment of ransomware. The extortion style is aggressive: attackers publish samples of stolen data on their leak site and threaten to release the full archive or sell it to other criminals if payment is not received by their deadline.

What to do

• Rotate any password you used when booking at Hotel Avenida, Hostal Espoz y Mina, Hostal Arriazu, or Pension Alemana and enable 2FA with an authenticator app on every account where that password was reused.
• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains back to this claimed breach.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same contact details used for travel bookings.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your accounts.

The incident underscores how quickly a routine hotel reservation can become the first link in a larger identity compromise chain. Acting promptly on the credentials and connections exposed here limits the window attackers have to exploit them. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to the same credential-stuffing attacks that follow incidents like this one.