www.onahotels.com Listed by lynx Ransomware Group

On September 4, 2025, the lynx Ransomware Group added www.onahotels.com to its public leak site, claiming that internal files had been exfiltrated from the Spanish hotel booking platform during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates the hospitality company’s internal documents were stolen and are now hosted on the group’s onion site. The exact number of people affected remains unknown, but customer records, booking details, and employee information are typical contents of hotel reservation systems. No specific volume of records or list of exposed data fields has been published by the attackers or the company as of this writing. The listing appeared on the lynx leak site with a reference number tying it to the incident.

Why This Matters for You and Your Family

When a hotel chain loses control of its internal files, the personal details you provided to book a room — email addresses, phone numbers, home addresses, dates of travel, and sometimes payment card information — can end up in the hands of criminals. These records often contain enough information to impersonate you, attempt account takeovers on travel sites, or combine with other leaks to build a profile that puts your family at risk. If children’s names or dates of birth were included in family bookings, those details can be used to target gaming accounts or open fraudulent services in their names.

The Doxxing and Identity-Chain Implications

A single breach like this rarely stays isolated. Attackers and data brokers routinely link an email or phone number found in one leak to usernames on social media, gaming platforms, and shopping sites. That process creates an identity chain that can lead to doxxing, swatting, or targeted phishing against you or your children. Credential leaks from hospitality systems frequently cascade into gaming account takeovers because families often reuse passwords across booking sites and online games. Once an attacker controls a child’s gaming profile tied to the family address, further harassment or extortion becomes easier.

Lynx Ransomware Group Track Record

Public reporting attributes the lynx Ransomware Group with emerging in late 2024. The group has listed hospitality companies, logistics firms, and mid-sized service providers among its victims. Its typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of internal files before encryption. The group then demands payment and, if unpaid, publishes samples or full datasets on its leak site to pressure the victim. Extortion is conducted through direct communication and public shaming on the onion portal.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you used on onahotels.com or similar booking sites and enable 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing your data is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that can chain back to the same address or email.
• Let remediation specialists perform hands-on takedown requests across data brokers and exposed profiles on your behalf.

The incident is a reminder that data you share with everyday services can surface months or years later in unexpected places. Starting with identity-chain mapping and continuous oversight gives you an early warning system and practical help when leaks occur. DoxxScan by GalaxyWarden delivers that combination of broad monitoring, AI-powered identity-chain mapping, specialist remediation, and full household protection including children’s gaming accounts.