On February 6, 2026, luxury travel company Pavlus Travel appeared on the leak site of the pear ransomware group. The listing indicates that internal files were exfiltrated during a ransomware attack on the firm, which specializes in high-end sea cruises, river cruises, and guided tours. Customers who booked with Pavlus, along with employees whose information sat in those systems, now face the possibility that sensitive personal and financial details have been stolen and could be published or sold.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Pavlus Travel
Get alerted the next time Pavlus Travel files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Pavlus Travel’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting on the pear leak site lists Pavlus Travel as a victim and states that internal files were taken. No exact victim count has been released, and the precise volume or type of data remains unclear beyond the broad description of internal documents. The incident follows the typical ransomware pattern of encryption followed by data exfiltration and extortion pressure. Available reporting describes the data as having been obtained in a ransomware attack, with the company’s name published on the group’s public leak page on the stated date.
Why This Matters for You and Your Family
When a travel company loses control of its internal files, the information inside often includes names, addresses, phone numbers, email addresses, dates of birth, passport copies, payment card details, and booking histories. If you or anyone in your family has ever taken a cruise or guided tour with Pavlus, those records may now sit in the hands of criminals. That data can be used to file fraudulent tax returns, open accounts in your name, or serve as the foundation for more targeted scams. Travel-related breaches are especially risky because they frequently contain scanned identification documents that are difficult to replace and carry long-term consequences for credit, insurance, and government benefits.
The Doxxing and Identity-Chain Risk
Stolen travel records rarely stay isolated. Criminals combine them with information from other breaches to build detailed profiles. An email address found in the Pavlus files can be matched to gaming accounts, social-media handles, or school records belonging to you or your children. Once those links are made, attackers can move from simple identity theft to full doxxing—publishing home addresses, phone numbers, and family relationships online. Credential leaks like this one frequently cascade into account takeovers on gaming platforms, where children’s usernames and passwords are reused across services. The result is a chain that can expose an entire household.