Pan Pacific Hotels Group Listed by karakurt Ransomware Group

On June 28, 2023, the karakurt ransomware group listed Pan Pacific Hotels Group on its leak site, claiming that internal files had been exfiltrated during a ransomware attack. The hospitality company, a wholly-owned subsidiary of Singapore-listed UOL Group Limited, saw corporate and personal documents exposed, including contracts along with SSNs, passports, and drivers licenses. The listing indicated that more than 40 GB of data would be released if demands were not met. Anyone who has stayed at or worked with Pan Pacific properties, particularly Pan Pacific Melbourne, may have information now in the hands of extortionists.

Reported Details from the Listing

The karakurt leak site states that Pan Pacific Hotels Group suffered a ransomware incident resulting in the theft of internal files. The disclosure does not quantify the exact number of affected individuals, nor does it list every data type beyond referencing contracts and identifiable documents such as social security numbers, passports, and drivers licenses. The primary source makes clear that 40+ GB of data are coming, a volume that suggests a significant cache of both operational records and personal information was taken. No ransom amount is publicly detailed on the listing itself.

Why This Matters for You and Your Family

When a hotel group loses control of guest contracts, employee records, or vendor agreements containing SSNs, passports, and drivers licenses, the risk extends far beyond the company. If you have ever provided identification details during a booking, corporate event, or employment process at a Pan Pacific property, those records could now be used to open accounts, file fraudulent tax returns, or impersonate you. Your family members listed on the same reservations or shared addresses face the same exposure. The breach turns what once felt like routine hospitality paperwork into long-term identity fuel.

The Doxxing and Identity-Chain Implications

Stolen passports and drivers licenses are high-value items on underground markets because they link real names, dates of birth, and document numbers to email addresses or phone numbers found in the same files. Attackers can chain these credentials across travel databases, loyalty programs, and financial services. A single exposed contract can reveal not only your identity but also travel patterns, family member names, and payment details. This creates persistent doxxing pathways that can surface in harassment campaigns or targeted fraud years later. Credential leaks of this nature also cascade into account takeovers on gaming platforms, where children’s usernames and reused passwords become easy follow-on targets.

Karakurt’s Publicly Known Track Record

Public reporting attributes the karakurt group’s emergence to late 2021. The operators have targeted organizations across healthcare, manufacturing, and hospitality sectors, often listing victims on their dark-web portal when initial extortion demands go unmet. Their typical playbook involves gaining initial access through compromised credentials or vulnerable remote desktop services, exfiltrating data before deploying ransomware, and then running a double-extortion operation that combines encryption with the threat of data publication. The group is known for relatively quiet periods punctuated by batches of new listings, focusing pressure on victims through incremental data dumps rather than immediate mass release.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity drawn from this and prior exposures.
• Rotate any password you used for Pan Pacific online accounts, loyalty portals, or reservations anywhere it has been reused, and switch to 2FA via an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing your data is caught and acted on in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts which often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests for any exposed personal documents appearing on data broker or underground sites.

The incident underscores how quickly hospitality data can fuel identity crimes long after the initial breach notice fades. One short forward-looking step is to treat every hotel or travel booking as a potential link in your identity chain and monitor it accordingly. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children’s gaming accounts. Starting your DoxxScan trial gives you and your family the advantage of early detection and expert cleanup before criminals can connect the dots.