Hoteles Globales Listed by malas Ransomware Group

On April 09, 2023, Hoteles Globales appeared on the leak site operated by the malas ransomware group. The listing states that the hospitality company suffered a ransomware attack in which internal files were exfiltrated after attackers exploited a vulnerability in the company’s Zimbra collaboration server. The leak-site posting does not specify the number of records affected or list exact data types beyond “internal files.”

Details from the Malas Listing

The primary disclosure on the malas leak site states that Hoteles Globales was listed as a “defaulter” after refusing to meet the group’s demands. It explicitly notes the initial access vector as a Zimbra vulnerability and states that attackers successfully exfiltrated internal files before encrypting systems. No sample data appears in the public posting, and the exact volume or sensitivity of the stolen files remains undisclosed by both the threat actor and the victim. The listing follows the group’s standard format, displaying the company name, date of publication, and a countdown timer that had already expired by the time the entry became public.

Why This Matters for You and Your Family

When a hotel chain’s internal files are stolen, the exposure often reaches beyond corporate walls. Reservation records, customer contact details, payment information, and employee personnel files can easily contain the personal data of ordinary guests and staff. If your family has stayed at any Hoteles Globales property in recent years, your names, addresses, phone numbers, email addresses, or payment card details may now sit in an attacker-controlled archive. Even without an exact victim count, the disclosure indicates that any information handled by the company’s Zimbra-linked systems is at risk of eventual public release or private sale.

Doxxing and Identity-Chain Risks

Stolen internal files frequently create long-term doxxing chains. A single leaked email or phone number can be cross-referenced with credential-stuffing databases, public records, and social-media handles to build a complete profile of you and your household. Threat actors then target linked accounts — including children’s gaming profiles that reuse the same email or password — to escalate from data theft to full identity takeover. Once an attacker controls one family member’s account, they can harvest additional addresses, dates of birth, and financial details that make further extortion or fraud simpler. These cascading compromises can continue for years after the original breach notification.

Malas Ransomware Group Track Record

Public reporting attributes the malas ransomware group’s emergence to late 2022. The group has focused primarily on mid-sized organizations across Europe and Latin America, with prior victims including logistics firms, manufacturers, and other hospitality operators. Their typical playbook begins with exploitation of unpatched internet-facing services such as Zimbra, followed by rapid exfiltration of documents before deploying ransomware. Rather than lengthy double-extortion negotiations, malas tends to publish victim data on their dark-web leak site after a short payment window expires. They rely on volume and consistent pressure rather than sophisticated negotiation tactics, according to multiple independent ransomware trackers.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you ever used with Hoteles Globales or their Zimbra systems anywhere it has been reused, and switch to a hardware-backed authenticator app for 2FA.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught within hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same breached email or address.
• Let DoxxScan remediation specialists handle ongoing takedown requests for any personal records that surface on data-broker or extortion sites.

The Hoteles Globales breach illustrates how quickly a single unpatched server can place thousands of ordinary families in the crosshairs of ransomware operators. Staying ahead of these expanding identity chains requires more than reactive password changes. Start your DoxxScan trial today and combine its continuous monitoring, AI-powered identity-chain mapping, and hands-on specialist remediation to protect yourself and your family — including gaming accounts that attackers love to hijack.