✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Hospitality
Breach intelligence, attack campaigns, and threat reports targeting the Hospitality sector.
Explore Other Sectors
Hospitality Threat Reports
BlackFile Extortion Group's Vishing Attacks on Retail and Hospitality
In February 2026, the BlackFile extortion group initiated a series of data theft and extortion attacks targeting retail and hospitality organizations. Employing voice phishing (vishing) tactics, they impersonated corporate IT helpdesk staff to deceive employees into divulging credentials. With these credentials, the attackers accessed systems like Salesforce and SharePoint, exfiltrated sensitive data, and demanded seven-figure ransoms. The group also engaged in swatting to pressure victims further. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/?utm_source=openai)) This incident underscores the evolving sophistication of social engineering attacks, particularly vishing, in the retail and hospitality sectors. The BlackFile group's methods highlight the critical need for organizations to enhance their security awareness training and implement robust authentication measures to mitigate such threats.
3 months ago
Kill Chain
BlackFile's Vishing Attacks: A Wake-Up Call for Retail and Hospitality Sectors
In early 2026, the BlackFile extortion group initiated a series of data theft and extortion attacks targeting retail and hospitality organizations. Employing voice phishing (vishing) tactics, they impersonated IT support staff to deceive employees into divulging credentials and one-time passcodes. With these credentials, BlackFile registered their own devices to bypass multi-factor authentication, escalated access to executive accounts, and exfiltrated sensitive data from platforms like Salesforce and SharePoint. The stolen data was then used to pressure victims into paying seven-figure ransoms, with threats of public disclosure on their dark web leak site. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/?utm_source=openai)) This incident underscores a significant shift in cybercriminal tactics, highlighting the increasing prevalence of vishing attacks that exploit human vulnerabilities rather than technical system flaws. The success of such social engineering methods emphasizes the need for organizations to enhance employee training and implement robust verification protocols to mitigate similar threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/?utm_source=openai))
2 months ago
Kill Chain
Scattered Spider Hacker Arrested in Finland Faces U.S. Charges
In April 2026, a 19-year-old dual U.S. and Estonian citizen, known online as "Bouquet," was arrested at Helsinki Airport in Finland while attempting to board a flight to Japan. U.S. federal prosecutors have charged him with wire fraud, conspiracy, and computer intrusion, alleging his involvement in at least four cyberattacks orchestrated by the Scattered Spider hacking group. These attacks, dating back to March 2023, targeted multiple large corporations, resulting in millions of dollars in ransom payments and significant operational disruptions. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/us-reportedly-charges-scattered-spider-hacker-arrested-in-finland/?utm_source=openai)) This arrest underscores the persistent threat posed by cybercriminal groups like Scattered Spider, which employ sophisticated social engineering tactics to infiltrate organizations. The incident highlights the critical need for robust cybersecurity measures, including advanced threat detection and employee training, to mitigate the risks associated with such attacks.
2 months ago
Kill Chain
DigitalMint Negotiator's Betrayal: A Stark Warning for Cybersecurity
In April 2026, Angelo Martino, a former ransomware negotiator at DigitalMint, pleaded guilty to conspiring with the BlackCat (ALPHV) ransomware group to extort five U.S. companies. Martino exploited his position by sharing confidential information, including victims' insurance policy limits and negotiation strategies, with the attackers. This collaboration led to ransom payments totaling approximately $75.3 million from sectors such as nonprofit, hospitality, financial services, retail, and medical industries. Martino faces up to 20 years in federal prison, with sentencing scheduled for July 9, 2026. This case underscores the critical need for stringent vetting and oversight of cybersecurity professionals, as insider threats can significantly amplify the impact of cyberattacks. The incident also highlights the evolving tactics of ransomware groups, emphasizing the importance of comprehensive security measures and employee integrity in safeguarding organizational assets.
3 months ago
Kill Chain
Booking.com Data Breach 2026: What You Need to Know
In April 2026, Booking.com, a leading online travel platform, experienced a data breach where unauthorized third parties accessed customers' reservation information. The compromised data included full names, email addresses, postal addresses, phone numbers, and communications shared with property providers. Upon detection, Booking.com promptly reset reservation PINs and notified affected users via email, advising them to remain vigilant against potential phishing attempts. ([techcrunch.com](https://techcrunch.com/2026/04/13/booking-com-confirms-hackers-accessed-customers-data/?utm_source=openai)) This incident underscores the persistent threat of cyberattacks targeting the travel and hospitality industry, emphasizing the need for robust data protection measures. As cybercriminals increasingly exploit personal data for fraudulent activities, organizations must enhance their security protocols to safeguard customer information.
3 months ago
Kill Chain
Ajax Amsterdam Data Breach: A Wake-Up Call for Sports Cybersecurity
In March 2026, Ajax Amsterdam, a prominent Dutch football club, experienced a significant data breach due to vulnerabilities in its IT systems. An unauthorized individual accessed personal information of approximately 300,000 fans, including email addresses and, for a subset, names and dates of birth. The breach also allowed manipulation of season tickets and stadium bans, posing serious security risks. The club has since patched the vulnerabilities, engaged external experts for investigation, and notified relevant authorities. This incident underscores the critical importance of robust cybersecurity measures in the sports industry, especially as digital platforms become integral to fan engagement and operations. Organizations must proactively assess and fortify their systems to prevent unauthorized access and protect sensitive user data.
4 months ago
Kill Chain
Critical Vulnerability in Pharos Controls Mosaic Show Controller: CVE-2026-2417
In March 2026, a critical vulnerability (CVE-2026-2417) was identified in Pharos Controls' Mosaic Show Controller firmware version 2.15.3. This flaw allows unauthenticated attackers to execute arbitrary commands with root privileges, potentially compromising the integrity and functionality of the affected devices. Pharos Controls has released firmware version 2.16 to address this issue and recommends that all users upgrade promptly to mitigate the risk of exploitation. This incident underscores the importance of timely firmware updates and robust authentication mechanisms in industrial control systems. Organizations utilizing such systems should prioritize regular security assessments and implement comprehensive access controls to safeguard against similar vulnerabilities.
4 months ago
Kill Chain
Phishing Campaign Targets Multiple Sectors with Advanced Evasion Techniques
In early 2026, a sophisticated phishing campaign targeted the healthcare, government, hospitality, and education sectors across multiple countries. Attackers employed advanced evasion techniques, including the use of hidden text and zero-font tactics, to bypass traditional email security measures. The campaign involved sending emails that appeared to be from legitimate sources, such as internal IT departments or trusted vendors, tricking recipients into clicking malicious links or downloading malware. Once compromised, attackers gained unauthorized access to sensitive information, leading to data breaches and operational disruptions. This incident underscores the increasing sophistication of phishing attacks and the need for organizations to enhance their cybersecurity defenses. The use of advanced evasion techniques highlights the importance of continuous monitoring, employee training, and the implementation of multi-factor authentication to mitigate such threats.
4 months ago
Kill Chain
Caesars Entertainment 2023 Loyalty Program Data Breach: A Wake-Up Call for Cybersecurity
In September 2023, Caesars Entertainment disclosed a cyberattack that compromised the personal data of its loyalty program members, including Social Security and driver's license numbers. The breach, attributed to the cybercriminal group 'Scattered Spider' operating under the ALPHV/BlackCat syndicate, did not disrupt casino or online operations. Reports suggest Caesars may have paid a partial ransom of $15 million, though the total demand was $30 million. This incident underscores the growing threat of loyalty program fraud, where attackers exploit personal data for financial gain. The rise in such breaches highlights the need for enhanced security measures and consumer vigilance to protect sensitive information.
4 months ago
Kill Chain
DigitalMint Insider Ransomware Scheme Unveiled
In 2023, Angelo John Martino III, a ransomware negotiator at DigitalMint, exploited his position to orchestrate at least 10 ransomware attacks, extorting over $75 million. Martino, along with co-conspirators, infiltrated networks, encrypted data, and demanded ransoms, even negotiating with victims he had attacked. This breach highlights the severe risks posed by insider threats in cybersecurity firms. The incident underscores the critical need for robust internal controls and vigilant monitoring to prevent such breaches, especially as ransomware tactics evolve and insider threats become more sophisticated.
4 months ago
Kill Chain
AirSnitch: Unveiling the 2026 Wi-Fi Vulnerability
In February 2026, researchers from the University of California, Riverside, and KU Leuven's DistriNet lab unveiled 'AirSnitch,' a novel attack that exploits fundamental flaws in Wi-Fi client isolation mechanisms. By leveraging cross-layer identity desynchronization, AirSnitch enables attackers to perform full bidirectional man-in-the-middle (MitM) attacks, allowing them to intercept and modify data between clients on the same network. This vulnerability affects a wide range of devices, including consumer routers from Netgear, Tenda, D-Link, TP-Link, and Asus, as well as enterprise hardware from Ubiquiti and Cisco. The attack is particularly concerning as it bypasses existing Wi-Fi encryption protocols without the need to crack them, posing significant risks to both home and enterprise networks. ([arstechnica.com](https://arstechnica.com/security/2026/02/new-airsnitch-attack-breaks-wi-fi-encryption-in-homes-offices-and-enterprises/?utm_source=openai)) The discovery of AirSnitch underscores the urgent need for standardized and robust client isolation implementations in Wi-Fi networks. As the attack exploits architectural weaknesses rather than specific software flaws, addressing this vulnerability requires coordinated efforts from hardware manufacturers, software developers, and standards organizations to enhance the security of wireless communications. ([cyberkendra.com](https://www.cyberkendra.com/2026/02/new-airsnitch-attack-bypasses-wpa2-and.html?utm_source=openai))
4 months ago
Kill Chain
Wynn Resorts Data Breach 2026: ShinyHunters' Latest Target
In February 2026, Wynn Resorts, a prominent Las Vegas-based hospitality company, confirmed a data breach involving unauthorized access to employee information. The cybercriminal group ShinyHunters claimed responsibility, alleging the theft of data affecting over 800,000 individuals. The compromised information reportedly includes names, email addresses, phone numbers, positions, salaries, start dates, and birth dates. ShinyHunters demanded a ransom of 23.34 Bitcoin (approximately $1.55 million) by February 23, 2026, threatening to release the data on the dark web if their demands were not met. Analysts suggest the breach may have exploited a vulnerability in Oracle PeopleSoft software, potentially through a compromised employee account. ([techradar.com](https://www.techradar.com/pro/security/top-las-vegas-hotel-is-the-latest-shinyhunters-ransomware-victim-hackers-demand-usd1-5-million-to-not-leak-data?utm_source=openai)) This incident underscores the escalating threat posed by sophisticated cybercriminal groups like ShinyHunters, who employ advanced social engineering techniques such as voice phishing (vishing) to infiltrate organizations. The breach highlights the critical need for robust cybersecurity measures, including regular system updates, comprehensive employee training on phishing tactics, and the implementation of multi-factor authentication to safeguard sensitive data.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports