treehotel.co.uk Listed by funksec Ransomware Group

On January 27, 2025, the website of Treehotel.co.uk, a Swedish treehouse accommodation provider, appeared on the leak site of the funksec ransomware group. Internal files were allegedly exfiltrated during a ransomware attack, exposing data that could affect guests, employees, and anyone whose personal or payment information was stored in the company’s systems.

What's Publicly Reported from Reporting

Public reporting indicates that funksec listed Treehotel.co.uk on its dark web leak portal on 27 January 2025. The data consists of internal files exfiltrated after the group gained access to the company’s network. The exact number of people affected remains unknown, and the precise contents of the leaked files have not been independently verified by third parties. Treehotel operates distinctive treehouse lodgings in Sweden, including themed rooms, and holds guest records, booking details, and operational documents that would typically contain names, contact information, dates of stay, and payment data.

Why This Matters for You and Your Family

When a company that holds your travel or lodging reservations is breached, the information it stores about you can appear on criminal forums within days. Names, email addresses, phone numbers, and payment details are frequently used to attempt account takeovers, craft convincing phishing messages, or build profiles for identity theft. For families, a single breach can expose both parents’ details and children’s information if family bookings or loyalty accounts were involved. Once that data circulates, it can surface months or years later in unexpected ways, from spam calls to more targeted fraud.

The Doxxing and Identity-Chain Risks

Credential leaks like this one often cascade beyond the original victim company. Criminals combine exposed email addresses with passwords reused on other sites, gaming platforms, or social media accounts. This creates an identity chain that links your booking history at Treehotel to your everyday online handles. Available reporting describes how such chains enable doxxing, where attackers publicly release personal addresses, phone numbers, or family member names. Gaming accounts belonging to children are particularly vulnerable because they frequently share the same email address or password patterns used for family travel bookings.

Funksec’s Publicly Known Track Record

Public reporting attributes the funksec ransomware group with operations that emerged in recent years. The group typically gains initial access through common vectors such as phishing or unpatched software, exfiltrates data before encrypting systems, and then posts samples on its leak site to pressure victims into payment. Notable prior targets have included various small-to-medium businesses across Europe and North America. Their playbook relies on public embarrassment and the threat of full data release rather than sophisticated encryption alone, according to available ransomware trackers.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, travel accounts, and real-world identity so you can see the full exposure picture.
• Rotate any password you used on treehotel.co.uk or any related booking site, then enable 2FA with an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught and addressed within hours rather than months.
• Cover the household with DoxxScan family protection that extends to children’s gaming accounts and any shared family email addresses that could link back to the Treehotel breach.
• Let remediation specialists handle data broker takedowns and removal requests on your behalf while you focus on securing your own accounts.

The Treehotel incident is a reminder that travel and lifestyle companies hold information that feels harmless until it is stolen and combined with data from other breaches. Taking concrete steps now limits how far criminals can travel down the identity chain that begins with this leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to understand your exposure and begin closing the gaps.