The Fifty/50 has been listed on the Qilin ransomware group's leak site. According to the listing, the hospitality business is accused of being the victim of a ransomware-extortion incident. The company has not publicly confirmed the claim as of this writing. The record, dated September 22, 2026, does not state how many people were affected, does not list any specific categories of information, and does not provide an incident date.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch The Fifty/50
Get alerted the next time The Fifty/50 files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about The Fifty/50’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What a Leak-Site Listing Actually Establishes
Ransomware groups like Qilin routinely publish victim names on leak sites to pressure companies into paying. These listings are produced by the attackers themselves. They are marketing material, not audited evidence. Many turn out to be exaggerated, recycled from older incidents, or simply false. Some companies never comment publicly, which leaves the claim hanging in public view indefinitely. A leak-site listing alone does not prove that a breach occurred, that any customer data was taken, or that the data was genuine. Real confirmation would require an official statement from The Fifty/50, a regulatory filing that clearly describes the incident, or independent verification by a trusted third party. Until one of those appears, this remains an unverified accusation.
The Hospitality Sector Pattern
Hospitality businesses continue to appear frequently on ransomware leak sites. The sector often handles reservations, loyalty programs, and payment details that attackers believe can create public pressure. This pattern does not tell you what happened at The Fifty/50 specifically, but it does suggest that similar claims are likely to surface again in the coming months. For you, that means treating any hospitality account password as single-use: never reuse it across other services. It also means paying closer attention to unexpected login attempts or password-reset emails from restaurants, hotels, or bars where you hold accounts.
What Cannot Be Changed Versus What You Still Control
What matters most right now is the credential risk. Changing it — and ensuring it is unique — is the single most effective step available to you.