Reported Holiday Inn Data Leak Exposes 500+ Customers After Ransom Was Unpaid
Summary
EcomWall reported that the SafePay group stole and published data linked to Holiday Inn Vilnius, including information on 500+ customers and over 100 employees. The hotel says authorities are investigating.
Key points
- EcomWall identified the incident and attributed the attack to the SafePay ransomware group; its representative said data was copied on September 24 and published overnight October 1–2 after the ransom was not paid.
- EcomWall reported about 74,000 files totaling 26.6 GB, including customer records for more than 500 people from over 45 countries.
- Reported customer data included names, nationalities, home addresses, hotel stay dates, and identity document numbers.
- Employee data reportedly included payroll and tax records for over 100 people, national identity numbers, income and tax information, and social insurance documents for 56 people.
- EcomWall's report also mentioned data belonging to Rib Room, a restaurant operated by Holiday Inn's owner, Valmeda.
- Holiday Inn said it was cooperating with Lithuanian and international authorities; a pre-trial investigation is underway, and the company declined to give further details.
Article Details
- Victim Organization
- Holiday Inn Vilnius (operated by Valmeda)
- Incident Type
- Ransomware attack and data theft, followed by publication of stolen data
- Incident Date
- 2026-09-24
- Data Types Exposed
- Customer names, nationalities, home addresses, hotel arrival and departure dates, and identity document numbers
- Employee national identification numbers, income and tax information, payroll and tax declarations, social insurance documents, passports, residence permits, identity cards, and employment and compensation records
- Rib Room restaurant data; specific data types not disclosed
- Affected Records
- More than 500 customers from over 45 countries; employee records covering more than 100 people, including social insurance documents for 56 people
- Affected Data Size
- Approximately 74,000 files or 26.6 GB, according to EcomWall
- Operational Impact
- No operational disruption was reported. The hotel said an investigation was ongoing and declined to provide further details.
- Ransom Or Extortion
- EcomWall's CEO said the attackers gave the hotel about four days to pay and published the data after it did not pay. The ransom demand amount was not reported.
- Claim Status
- claimed