rhactushotel.com Listed by lockbit5 Ransomware Group

On May 7, 2026, the ransomware group LockBit5 added rhactushotel.com to its public leak site, claiming that internal files had been exfiltrated from the Egyptian hotel operator in El-Alamein after an apparent ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates the incident involves a ransomware deployment that resulted in data exfiltration. The LockBit5 leak page lists Rhactus Hotel, a resort-style accommodation provider, and states that internal documents were stolen. No specific victim count has been published, and the precise volume or full list of exposed records remains undisclosed on the leak site. Available reporting describes the data as internal files rather than a structured database of customer records, though such files frequently contain guest names, contact details, booking information, payment references, and employee data in the hospitality sector.

The breach follows the group’s standard pattern of encrypting systems, exfiltrating selected data, and later publishing samples or full archives when demands are not met. As of the publication date on the leak site, no ransom deadline had been publicly updated, but LockBit5 typically issues short windows before full data publication.

Why This Matters for You and Your Family

When a hotel you or your family has stayed at loses control of internal files, the information that travels with a booking can be repurposed quickly. Guest names, email addresses, phone numbers, and booking histories are common in hospitality systems. Once those details appear on a ransomware leak site, they become searchable by identity thieves, phishing operators, and doxxers. Even if you were not directly notified, any reservation made in the past several years could have left traces that now sit in an attacker-controlled archive.

Your family’s exposure does not stop at one company. A single leaked phone number or email can be correlated with gaming accounts, school registrations, or family travel records. Children’s names and dates of birth sometimes appear in family bookings, creating long-term risks of identity fraud or targeted harassment.

The Doxxing and Identity-Chain Implications

Ransomware leaks like this one rarely remain isolated. Attackers and subsequent buyers often combine the new data with earlier breaches to build detailed profiles. A hotel booking might link an email address to a child’s gaming username, a parent’s workplace, or a home address listed for billing. These connections allow adversaries to escalate from simple credential theft to full identity takeover or public doxxing.

Credential leaks cascade into account takeovers across unrelated services. Once an attacker controls one account, they can request password resets elsewhere, especially when the same email or phone number is reused. Gaming platforms are frequent secondary targets because children’s accounts often have weaker passwords and are tied to family payment methods. The result is a chain that can expose location history, financial details, and personal relationships far beyond the original hotel breach.

LockBit5’s Publicly Known Track Record

Public reporting attributes LockBit5 as the latest iteration of the LockBit ransomware operation, which first gained notoriety in 2020. The group has targeted hospitals, schools, manufacturers, and hospitality providers worldwide. Notable prior victims include large corporations and public-sector organizations whose data appeared on successive versions of the LockBit leak site. Their typical playbook begins with initial access through phishing, remote desktop protocol weaknesses, or stolen credentials, followed by lateral movement, data exfiltration, encryption, and extortion. Demands are usually communicated directly to the victim, with public leaks used as leverage when payment is refused. LockBit5 continues this model, maintaining an active leak site that lists new victims on a near-weekly basis.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the Rhactus Hotel breach.
• Rotate any password you used when booking at rhactushotel.com or similar hospitality sites, then enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught and addressed in hours rather than months.
• Cover the household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and payment details.
• Let remediation specialists handle takedown requests across data brokers and leak repositories while you focus on securing your own accounts.

The Rhactus Hotel breach is a reminder that data stolen in one industry can surface anywhere and affect anyone who interacted with the business. Taking concrete steps now limits how far attackers can travel along the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to gain visibility and control before the next leak escalates.