singita.com Listed by dragonforce Ransomware Group

On April 2, 2026, luxury safari operator Singita.com appeared on the leak site of the dragonforce ransomware group. The attackers claim to have exfiltrated internal files during a ransomware incident. While the exact number of people affected remains unknown, anyone who has stayed at a Singita lodge, camp, or private villa, or who has inquired about bookings, may have personal information now at risk.

What's Publicly Reported from Reporting

Public reporting on the dragonforce leak site indicates that Singita suffered a ransomware attack in which internal documents were taken before encryption. The data was published on the group’s onion site on April 2, 2026. No precise count of records or list of specific data fields has been released, but ransomware incidents of this type typically include guest names, contact details, booking information, payment records, and internal correspondence. Singita, founded in 1993, operates high-end conservation-focused properties across several African countries and maintains detailed guest profiles as part of its personalized hospitality model.

Why This Matters for You and Your Family

When a company that holds your travel details, email address, phone number, and possibly passport or payment information is breached, that data does not stay contained. It can be sold, cross-referenced, and used to target you months or years later. For families who have traveled with children, the exposure can extend to dependents whose names and dates of birth appear in booking records. Once criminals possess even a few accurate data points, they can attempt account takeovers on travel platforms, loyalty programs, or email accounts, creating further risk to your finances and privacy.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at posting data. They count on the information fueling secondary attacks. A leaked booking email can be linked to your social-media handles, streaming accounts, or children’s gaming logins. These connections form an identity chain that lets attackers impersonate you, reset passwords elsewhere, or harass family members. Credential leaks like this one frequently cascade into gaming-account takeovers, especially when parents reuse passwords or when children’s accounts are tied to a family email. The result is doxxing that can expose home addresses, phone numbers, and daily routines derived from safari itineraries.

Dragonforce Group Track Record

Public reporting attributes the dragonforce ransomware group with emerging in late 2023. The group has claimed responsibility for attacks on a range of organizations, including hospitality, healthcare, and technology companies. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files, deployment of ransomware, and publication of stolen data on their leak site when victims do not pay. Extortion demands often include both ransom for decryption and separate fees to prevent data release. Observers note that dragonforce frequently sets short deadlines once samples appear online.

What to do

• Run a DoxxScan to map every link between your email, phone, travel booking details, and real-world identity so you can see the full exposure from this incident.
• Rotate the password you used for any Singita-related booking or inquiry anywhere it has been reused, and switch on two-factor authentication through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and addressed in hours instead of months.
• Cover the household with DoxxScan family protection that includes children’s gaming accounts, which often become targets when credential leaks create doxxing chains back to the same home address.
• Let remediation specialists handle takedown requests for any exposed personal records appearing on data-broker or people-search sites.

The Singita breach is a reminder that even companies known for discretion can lose control of the personal information they collect. Taking concrete steps now limits how far attackers can travel down the identity chain created by this leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, and hands-on remediation by specialists who manage takedowns for you and your entire household, including children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed data.