sbh Listed by Qilin Ransomware Group

On June 24, 2025, the qilin ransomware group listed BH Hotels & Resorts on its leak site, claiming that internal files had been exfiltrated from the hospitality company’s systems. Guests and employees of the group’s properties in Fuerteventura, Lanzarote, and Zanzibar are among those whose personal information may now be exposed.

What Public Reporting Shows

Available reporting describes the incident as a ransomware attack in which qilin actors gained access to BH Hotels & Resorts’ internal network, copied sensitive files, and later published a sample on their data-leak portal. The company, which operates beachfront hotels emphasizing comfort, gastronomy, and family-friendly facilities, has not yet released an official statement detailing the precise volume of records involved. Public reporting indicates that the data includes internal documents that typically contain guest names, contact details, booking information, and employee records. No confirmed count of affected individuals has been published, but the nature of a resort operator’s records suggests thousands of past and recent guests could be impacted.

Why This Matters for You and Your Family

When a hotel chain suffers a breach, the information exposed is often exactly what criminals need to build convincing profiles. Names, addresses, phone numbers, email addresses, and payment details from family holidays can be combined with data from other breaches to impersonate you, open accounts in your name, or target your children with grooming or bullying attempts. For ordinary families who have stayed at these resorts, the breach means your vacation photos, children’s dates of birth, and travel itineraries may now sit on a ransomware site accessible to anyone willing to pay. The exposure is permanent; once data leaves the company’s control, you carry the risk indefinitely.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one company. Criminals use stolen guest records to map connections between email addresses, phone numbers, social-media handles, and family members. A single leaked booking confirmation can link a parent’s work email to a child’s gaming username, creating an identity chain that leads to doxxing, account takeovers, or extortion. Public reporting on similar incidents shows that credential leaks from hospitality firms frequently cascade into gaming-platform compromises because families often reuse passwords across hotel Wi-Fi logins, loyalty apps, and children’s Roblox or Fortnite accounts. The result is a widening circle of exposure that can affect every member of the household.