Zelena Laguna Hotel Listed by medusalocker Ransomware Group

On November 15, 2022, the Croatian hospitality company Zelena Laguna Hotel appeared on the leak site operated by the medusalocker ransomware group. The listing states that internal files were exfiltrated during a ransomware attack, although the exact volume and specific types of data remain undisclosed by the group.

Reported Details from the Listing

The medusalocker leak site entry states that Zelena Laguna Hotel was targeted in a ransomware operation and that attackers successfully removed internal files before encryption. No precise count of affected records is provided, nor does the listing enumerate the categories of information stolen. The disclosure simply asserts that the hotel chain’s internal data has been obtained and will be published if a ransom is not paid. As of the listing date, the group had not released samples, but the public claim alone places every guest, employee, and vendor who interacted with the company at potential risk.

Why This Matters for You and Your Family

When a hotel chain suffers a breach, the information at stake often includes names, addresses, phone numbers, email addresses, dates of stay, payment details, and sometimes passport or identity-document copies collected at check-in. Even without an exact record count, the exposure can affect thousands of travelers and local staff. If your family has ever stayed at a Zelena Laguna property or used their services, your personal details may now sit in an attacker’s archive. That data does not expire; it can be sold, traded, or used years later to support identity theft, phishing campaigns, or physical stalking.

The Doxxing and Identity-Chain Risk

Ransomware operators rarely stop at one dataset. A single leaked hotel booking can link your real name and home address to an email address, phone number, and travel companions. Those connections allow attackers to map an identity chain that reaches your social-media accounts, children’s gaming profiles, and financial services. Once the chain is built, credential-stuffing attacks become trivial and doxxing escalates quickly. Public reporting on similar incidents shows that hotel breaches frequently cascade into broader personal exposure because guests reuse the same passwords across travel sites, loyalty programs, and home accounts.

MedusaLocker’s Publicly Known Track Record

Public reporting attributes the first appearances of MedusaLocker to late 2019. The group has since hit healthcare providers, manufacturing firms, local governments, and hospitality companies across multiple continents. Their typical playbook begins with phishing or exploited remote-desktop credentials, followed by lateral movement inside the victim network, data exfiltration, and deployment of ransomware that also wipes backup systems. After encryption they wait a short period before listing the victim on their leak site, applying pressure through both operational disruption and the threat of public data release. The group’s extortion style is direct: pay or watch your internal files appear in clear text on a dark-web portal.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure that touches you or your family is caught in hours rather than months.
• Rotate any password you ever used when booking with Zelena Laguna Hotel or similar travel services, then replace it with a unique passphrase and enable 2FA through an authenticator app everywhere that credential was reused.
• Cover the household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle ongoing takedown requests across data-broker sites that may already be reselling the stolen hotel records.

The Zelena Laguna Hotel breach is a reminder that travel data is especially dangerous because it ties your real-world identity to digital accounts in ways that are hard to untangle later. Start your DoxxScan trial today and put continuous monitoring plus hands-on remediation by specialists between your family and the next wave of leaked personal information. Its identity-chain mapping and household coverage, including children’s gaming accounts, directly address the exact cascade that ransomware groups like MedusaLocker exploit.