Hotel DuPont Data Breach

The N0n ransomware group added Hotel DuPont (hoteldupont[.]com) to its leak site on October 19, 2026, a listing identified through SOCRadar’s dark web monitoring. Hotel DuPont is a historic luxury property in Wilmington, Delaware, operating in the United States hospitality sector. Hospitality organizations present attractive extortion targets because they hold high densities of guest personal data, rely on distributed property management and point-of-sale systems, and often operate with limited centralized security oversight. Guest PII and payment card data are high-value extortion material, which raises the potential impact of any compromise affecting the property. The claim appeared within a same-day cluster: alongside Hotel DuPont, N0n listed Kingwood Endoscopy, The Akeeli Group, and Finzly Corp, placing four US organizations on the leak site in a single publishing event that spanned healthcare, business services, financial technology, and hospitality. This cluster reflects the group’s broader pattern. N0n’s victims are exclusively US-based, and the group shows no tight vertical focus, instead pursuing accessible organizations across multiple sectors. Hotel DuPont fits this pattern well, combining the group’s exclusive US geographic focus with a sector whose distributed systems and valuable guest data align with its opportunistic, accessibility-driven targeting.

As part of the exposure assessment, SOCRadar queried its stealer-log telemetry for the victim domain hoteldupont[.]com. The query returned zero records, meaning no positive infostealer signal was found in connection with this listing. This null result does not equal no exposure. The telemetry corpus is paginated and bounded, so the query did not exhaust every available record, and credentials may exist under personal email aliases rather than the corporate domain or in feeds that the dataset did not capture. The absence of stealer-log records requires careful interpretation and cannot be read as confirmation that Hotel DuPont is unaffected. The null result means only that SOCRadar’s infostealer telemetry contains no records tied to hoteldupont[.]com within the queried, bounded corpus. It neither verifies nor refutes the details of N0n’s claim, and it does not rule out that the organization could have been compromised through means not reflected in this dataset. Credentials exposed under personal email aliases or held in uncaptured feeds would remain invisible to the query despite potentially existing. As with all ransomware leak-site entries, the Hotel DuPont listing remains an allegation rather than an independently confirmed breach. Recommended response actions for this listing are specific to the hospitality environment. Hotel DuPont should engage incident response, rotate all system credentials, and review property management system (PMS) and point-of-sale (POS) access logs for signs of unauthorized activity. If transaction data is potentially in scope, payment card networks should be notified. These steps concentrate on the property management and point-of-sale environment, the operational layer most directly implicated by the claim.