Kord Hotels Data Breach

LockBit 5 listed Kord Hotels, a Greek hospitality company, on its dark web portal on October 14, 2026. This listing extends LockBit 5’s European presence into the hospitality sector, an industry often targeted due to its valuable payment infrastructure and extensive guest data. Such data can provide ransomware operators with significant leverage beyond the impact of operational disruption. In the 60 days prior to this disclosure, LockBit 5 claimed 44 other victims. The group primarily targets the professional services and healthcare sectors, with a significant concentration of victims in Germany, the United States, and the Netherlands. While Kord Hotels’ hospitality sector is a less typical target for LockBit 5 compared to its usual focus areas, the company’s European operational base aligns with the group’s observed activity patterns in the region.

SOCRadar’s investigation for the domain kordhotels[.]gr returned no associated stealer-log records. However, the absence of such records does not confirm that the organization is unaffected. Credentials may exist in threat intelligence feeds not covered by this query, might be associated with personal email aliases, or could have already been rotated by the organization. For the LockBit 5 ransomware group, the primary method of obtaining initial access has been documented as involving initial access brokers (IABs). These brokers often source fresh logs from underground marketplaces. These logs typically contain validated corporate credentials, which are then used to gain access to victim environments, often through compromised Microsoft 365 accounts, VPN portals, or other remote access solutions, before being handed off for ransomware deployment. Therefore, a null result in stealer-log telemetry does not rule out this potential intrusion pathway for Kord Hotels. Hospitality organizations, by their nature, manage sensitive data including guest personal identifiable information (PII), payment records, and loyalty program details. This data profile makes them attractive targets for extortion, as it provides threat actors with leverage beyond the impact of solely disrupting operations. Given this listing, ongoing dark web monitoring and proactive credential auditing are recommended as appropriate responses.