pmsoffice.de Listed by lockbit3 Ransomware Group

On March 09, 2023, German hotel software provider pmsoffice.de appeared on the leak site operated by the LockBit3 ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the company, which develops the award-winning Hotline hotel management program used by small and large hotels across Europe. The disclosure does not specify the number of affected hotels, the volume of records involved, or the exact deadline set by the attackers.

Details from the Leak Site

The primary disclosure on the LockBit3 leak site indicates that the threat actors successfully stole internal files from pmsoffice.de before encrypting systems. It describes the victim as a provider of hotel software with TSE certification and notes connections to hotels that use its Hotline platform. The listing does not detail precisely what categories of data were taken, though ransomware groups of this type routinely exfiltrate customer databases, contracts, financial documents, and internal correspondence. No ransom amount is publicly listed in the initial disclosure.

LockBit3 published the sample files as proof of compromise, a standard step in their double-extortion playbook. The incident follows the group’s typical pattern of targeting small-to-medium businesses in Europe that handle sensitive operational data for client organizations.

Why This Matters for You and Your Family

If you have stayed at a hotel that uses pmsoffice.de’s Hotline software, your booking details, contact information, or payment records may now sit in an attacker-controlled archive. Even when exact record counts remain unknown, such breaches expose ordinary travelers and their families to long-term risks. Hotels often store guest names, addresses, phone numbers, email addresses, and sometimes passport or ID copies — information that retains value to identity thieves for years.

Smaller hotels and independent properties rely heavily on specialized software like Hotline. A single breach at the software provider can therefore cascade across dozens or hundreds of properties, quietly exposing guests who never interacted directly with pmsoffice.de. For families, this means children’s names and dates of birth may also have been included in reservation files, increasing the chance of synthetic identity fraud or targeted scams.

Doxxing and Identity-Chain Risks

Hotel booking data rarely exists in isolation. Attackers can combine leaked guest details with information from other breaches to build complete identity chains. A phone number tied to a hotel reservation can link to your social-media accounts, children’s gaming usernames, or family address history. Once these connections surface on underground forums, the risk of doxxing, SIM-swapping, or spear-phishing attacks rises sharply.

Credential leaks from related systems often follow. Support portals or partner logins used by hotels frequently reuse passwords across personal and business accounts. When those credentials appear alongside guest data, opportunistic criminals can hijack email, banking, or gaming profiles within hours of the information being sold or shared.

LockBit3’s Publicly Known Track Record

Public reporting attributes LockBit3 as the rebranded continuation of the original LockBit ransomware operation that first gained notoriety in 2020. The group re-emerged in early 2022 after a law-enforcement disruption and quickly regained momentum by recruiting affiliates and improving its leak-site infrastructure. Notable prior victims include large manufacturers, healthcare providers, and municipal governments across North America and Europe.

The group’s standard playbook begins with initial access gained through compromised remote desktop credentials, phishing, or vulnerable web applications. Once inside, operators exfiltrate data before deploying ransomware. They then demand payment for both decryption and non-disclosure of the stolen files. LockBit3 is known for aggressive deadlines, public shaming of non-paying victims, and occasional leaks of particularly sensitive internal documents to pressure targets. The pmsoffice.de listing fits this pattern exactly.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, hotel loyalty accounts, and real-world identity so you can see exactly what chains back to this claimed breach.
• Rotate any password you have ever used on hotel booking sites or loyalty programs and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your family’s data is caught and acted on within hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which frequently become targets when credential leaks cascade into account takeovers and doxxing chains.
• Let remediation specialists handle data-broker takedown requests and opt-out processes for you so exposed personal information does not remain easily available to criminals.

The pmsoffice.de breach demonstrates once again that software providers serving everyday industries can become high-value targets whose compromise quietly affects thousands of ordinary families. Staying ahead requires more than reactive checks; it demands ongoing visibility into how your personal data surfaces across the internet. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to close the gaps before the next leak appears.