Contact us Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks


Discovered 2026-05-14 16:47 UTC
Est. attack date 2026-05-14
Country SG

Description:

We are ShadowByt3$. We have claimed responsibility for hacking Hotelogix. They have been breached through there amazon s3 buckets and azure blobs. They were misconfigured which allowed us to scrape everything inside. This has been are latest campaign. If you don't pay $500,000 in btc or monero all data gets leaked. We are not joking and not playing we will. As you can tell in the sample in the data leak site or url below. We are giving you until April 14th at 12:20 it expires. It gets released. DarkWebinformer if you see this contact us asap through are telegram. Any researchers you can contact them and verify data. Also let them know what we have and have 6gb of data. Tell them if they don't pay by that date they get released and is not being put up for sale. Make the right decision and just getting law enforcement involved is just going to make it worse and as you can see they are helpless and don't do shit about you and don't care about companies. Look at how many companies get reported to the feds, you really think there going to help you. If you do your wrong. You can try to stop us but it doesn't stop the leaks from already being leaked and passed around other researchers or criminals. The following below was stolen: 1. Internal Corporate Data This data pertains to Hotelogix's own business operations and software development: - Operational Manuals: Internal guides for staff on how to use and manage their cloud-based systems. - Product Upgrade PDFs: Documentation detailing recent or upcoming software updates, which can reveal specific system architectures. - Branding Assets: Official logos, templates, and marketing materials (often used by hackers to create more convincing phishing emails). 2. Client-Specific Data (Treebo Hotels) The most critical part of the breach involves data belonging to Hotelogix’s clients. For Treebo Hotels, the stolen files include: - Customer Folios (Invoices): As seen in your image, these contain guest names, phone numbers, and home addresses. - Guest Stay Details: Specific dates of arrival and departure, room numbers, and room types (e.g., "Promotional Room Rent Oak"). - Payment Processing Details: While full credit card numbers are often encrypted, "processing details" can include: Last four digits of cards. Transaction IDs and dates. Billing amounts and tax breakdowns (GST/SGST).

Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 230

Third Party Employee Credentials: 6


External Attack Surface: 4


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abusegodaddy.com
MX Records
  • alt3.aspmx.l.google.com. Google Workspace
  • alt4.aspmx.l.google.com. Google Workspace
  • alt1.aspmx.l.google.com. Google Workspace
  • alt2.aspmx.l.google.com. Google Workspace
  • aspmx.l.google.com. Google Workspace
TXT Records
  • _globalsign-domain-verification=jiKLCpDl1jdymWWS-ItGUn39D9NpqHz0Ybo5zh1wjE
  • amazonses:8EyweLGl5Ga9+QYIQAPwa4UH3vCWR9xGuWGTetecVfQ=
  • atlassian-domain-verification=lYXEE+rEaahhN9fgTkhIn/6j+tc357cin3BlaIVS/nbLIc7WkNxTSR5KVvUBEsye
  • facebook-domain-verification=u5q6fappt82uv2a3sft4jhvy3lzurp
  • v=spf1 include:_spf.google.com include:one.zoho.com include:zcsend.net include:_spf.siteminder.com include:spf.protection.outlook.com ~all
  • MS=A5559328F1A8E3FEC7FB235502D499DACA23C81A
Cloud / SaaS Services Detected
Atlassian Amazon SES/WorkMail Global Sign