Westmont Hospitality Group Listed by alphv Ransomware Group

On January 31, 2023, Westmont Hospitality Group appeared on the leak site of the Alphv ransomware group. The hospitality management company, which oversees hotels and related facilities across North America, had its internal files exfiltrated during a ransomware attack. The listing does not specify how many individuals may be affected or exactly which records were taken.

Details from the Leak Site

The Alphv leak page states that Westmont Hospitality Group suffered a ransomware intrusion and that attackers successfully exfiltrated internal files before encryption. No victim count, no list of specific data types, and no ransom amount appear in the posting. The disclosure indicates the company was given a deadline to negotiate or face full publication of the stolen material. Public mirrors of the leak site, such as ransomware.live, preserve the original Alphv entry with its timestamp of January 31, 2023.

Internal files were the only category mentioned. The notification does not describe whether customer records, employee payroll, vendor contracts, or reservation databases were included.

Why This Matters for You and Your Family

When a hotel management company loses control of internal files, the exposure can reach guests, employees, and their households. Reservation details often contain names, home addresses, phone numbers, email addresses, and payment card information. Employee files can hold Social Security numbers, dates of birth, and direct-deposit banking data. Any of these records can be sold or used to launch further attacks against you or your family members.

A single breach like this creates long-term risk because stolen data circulates for years on underground markets. If you stayed at a Westmont-managed hotel, worked for the company, or had a family member do either, your information may already be in attackers’ hands even though the exact scope remains unknown.

Doxxing and Identity-Chain Risks

Exfiltrated internal files frequently contain spreadsheets that link personal details to usernames, email addresses, or customer IDs. Attackers combine these fragments with data from previous breaches to build complete identity profiles. A hotel booking under your name can be chained to your email, phone number, and children’s school or sports registrations. The result is doxxing that escalates from simple spam to targeted fraud, account takeovers, and physical stalking.

Credential leaks from hospitality systems often cascade into gaming accounts. Children’s Roblox, Fortnite, or Steam logins reused from a parent’s compromised email become entry points for further harassment and identity theft. The Alphv listing underscores how one corporate breach can ripple outward to every member of a household.

Alphv’s Known Track Record

Public reporting attributes the Alphv group, also known as BlackCat, with emerging in late 2021. The gang has claimed responsibility for attacks on dozens of organizations, including large healthcare providers, manufacturing firms, and other hospitality operators. Their typical playbook begins with phishing or exploitation of remote desktop services, followed by rapid lateral movement, data exfiltration, and then dual extortion: demanding payment both to decrypt systems and to prevent release of stolen files.

Alphv operators have repeatedly demonstrated willingness to publish sensitive data when victims refuse to pay. The group maintains a professional leak site and uses affiliate partners to scale operations. Exact success rates are unknown, yet the volume of victims listed on their platform shows a consistent pattern of follow-through on publication threats.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by specialists.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you used for Westmont-related reservations or employee portals anywhere it has been reused, and switch to 2FA through an authenticator app instead of text messages.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts tied to the same address or parent email.
• Let remediation specialists manage takedown requests for any exposed personal records that surface on data-broker or extortion sites.

The incident shows that even established hospitality operators remain vulnerable to determined ransomware groups. Acting quickly on the information now available can limit how far attackers push the stolen data. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts at risk from cascading credential leaks.