1. Executive summary
On 2026-11-04 the leak-site operator "BYOD" posted a claim to have breached IHG Hotels & Resorts (Estate), asserting possession of customer data, AWS keys, "Full Access to CyberArk", complete employee PII, booking and loyalty data, reservation and payment ledgers, Active Directory access and "All Financial Records". The post is an operator claim published on a leak-site index; no victim confirmation, sample data, access vector or timeline is provided, and no CVE or exploitation state is recorded. BYOD has no MITRE ATT&CK profile, so the attribution is unconfirmed. For EMEA financial services the direct exposure is low unless a client holds IHG loyalty, booking or corporate-travel data, or connects to IHG systems; the material risk is third-party and supply-chain, and clients should treat the claimed AWS key and CyberArk access as a credential-compromise scenario to be verified, not assumed.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28 | The claim asserts AWS keys and "Full Access to CyberArk", i.e. compromise of a third party's cloud and privileged-access infrastructure that clients may depend on | Clients using IHG booking, loyalty or travel-management integrations should review ICT third-party arrangements and confirm whether IHG is a named provider in their register |
| NIS2 Art. 21(2)(d) | The same third-party credential exposure sits in the supply chain of any entity relying on IHG services | Entities in scope should assess supply-chain security measures for this dependency and record the outcome |
No other article in scope is engaged by the facts as reported.
3. Technical analysis & attack chain
The only confirmed fact is the leak-site listing itself: BYOD posted an entry naming IHG Hotels & Resorts (Estate) on 2026-11-04, with a description asserting data theft and access. Everything below the listing is the operator's own claim and is unverified.
The operator's post makes these assertions, none corroborated by a second source:
- It claims a weak LDAP binding password of "123" and states that rotating credentials "won't really save you" because re-entry to the network is easy. This is a claim about IHG's directory configuration, not an observed technique.
- It claims possession of customer data, AWS keys, "Full Access to CyberArk", complete employee PII, and booking information including guest name, billing address, company, rate code, room charges, taxes, spend, and property and stay dates.
- It claims the loyalty data store and reservation and payment ledgers for the folio reservation (guest name, address, phone, email, arrival and departure, rate, property), plus "Access to the AD + All Financial Records".
- It names brands said to be affected: Six Senses, Holiday Inn, Holiday Inn Express, Staybridge Suites, Garner, Candlewood, Crowne Plaza and Mayfair Hotel.
- It states the operator will "take you down when communication has been established", i.e. an extortion demand contingent on contact.
What the listing does not establish: the initial access vector, the date or duration of any intrusion, the volume of data taken, whether the data is genuine, whether CyberArk or AWS access is live, or whether IHG has confirmed any of it. No malware, tooling, command line, file path, registry key, C2 address or hash is given. No CVE is associated with this item and no exploitation state is recorded.
The "123" LDAP password claim, if true, would describe a weak-credential exposure in directory authentication rather than a software vulnerability; it is single-sourced to the operator and should be treated as an assertion to be tested by the victim, not a finding.
A separate BYOD listing in the same index names Standpointe / Trinite Solutions and claims financial statements, customer bank accounts, cheque registers and tax records. It is a different victim and a different event; it contributes no facts, indicators or victims to this advisory and is noted only because it shows the same operator posting finance-adjacent claims.
4. Mitigation & containment
P1 (within 24h)
- If your organisation holds an IHG integration (booking, loyalty, corporate travel, SSO federation), ask the IHG account owner to confirm whether the claimed AWS key and CyberArk access are real and revoked. Do not act on the claim as fact until IHG responds.
- Rotate any credential your organisation shares with IHG systems (API keys, service accounts, federation secrets) as a precaution, and log the rotation.
- Search your own logs for authentication to IHG-linked endpoints from unexpected source addresses or at unusual times over the past 30 days.
P2 (within 72h)
- Review whether IHG appears in your ICT third-party register and whether the arrangement is material under your DORA Art. 28 process; record the review.
- If you consume IHG loyalty or booking data, check for downstream exposure of guest or employee PII in your own stores and confirm retention limits.
P3 (within 7 days)
- Where your entity is in NIS2 scope, document the supply-chain assessment for this dependency under your Art. 21(2)(d) measures.
- Re-test directory authentication hygiene on any system you control that binds over LDAP: confirm binding accounts do not use trivial passwords and that rotation is enforced.
No fixed release, patch or vendor remediation is named in public reporting, because the item describes a claimed breach rather than a patched vulnerability.
5. Indicators of compromise
No indicators of compromise available in the source material.
The listing gives no hashes, domains, IP addresses, file paths or command lines. The only observable is behavioural: the leak-site post itself.
| behaviour | where to observe | confidence |
|---|---|---|
| Operator claims LDAP binding with password "123" | Directory authentication logs on IHG-side or federated systems | Low (operator claim only) |
| Claimed use of AWS keys and CyberArk access | Cloud provider audit logs (AWS CloudTrail) and CyberArk audit trail, if you have visibility | Low (operator claim only) |
6. Detection
Insufficient indicators to author detection rules.
The source contains no malicious file, command line, registry key, scheduled task or network artefact from which a YARA or Sigma rule could be built. The only string of note, the claimed password "123", is a configuration weakness, not a threat artefact, and would not support a reliable rule.
7. Sources
- Ransomware.live, "Ransomware: BYOD named IHG Hotels & Resorts (Estate) (GB)", https://www.ransomware.live/id/SUhHIEhvdGVscyAmIFJlc29ydHMgKEVzdGF0ZSlAQllPRA==, 2026-11-04
- Ransomware.live, "Ransomware: BYOD named Standpointe / Trinite Solutions", https://www.ransomware.live/id/U3RhbmRwb2ludGUgLyBUcmluaXRlIFNvbHV0aW9uc0BCWU9E (separate event, no facts used)
8. Adverse Trace position
Adverse Trace assesses this as a low-severity item for EMEA financial services on the current evidence: it is a single leak-site claim with no victim confirmation, no CVE, no exploitation state and no indicators, and the named victim is a hospitality group rather than a financial entity. The claim is single-sourced to the operator and unconfirmed; BYOD has no MITRE ATT&CK profile, so no actor attribution is made. Client impact rises only where a client has a direct IHG data or system dependency, in which case the claimed AWS key and CyberArk access warrant the P1 credential-rotation checks above. We will monitor for IHG confirmation, for any sample data or indicators published by the operator, and for DORA Art. 28 and NIS2 Art. 21(2)(d) supply-chain implications, and will reissue if corroboration or indicators appear.
Published via PulseTrace — Adverse Trace threat intelligence.