Ransomware victim disclosure
← All victimsjparkislandresort
Claimed by stormous · listed 19 days ago
Status timeline
- Listed
May 2, 2026
- Data leaked
At a glance
- Group
- stormous
- Status
- Data leaked
- Country
- SG
- Sector
- Hospitality and Tourism
- Listed on leak site
- May 2, 2026
About the victim
AI dossier — public-source company profileJ Park Island Resort appears to be a resort property operating in Singapore (SG), based on the country attribution. The resort is associated with booking platforms including HeyTripGo and maintains reservation databases for guests. No further verifiable details about scale or founding are available from the provided data.
- Industry
- Hospitality & Resort Management
Attack summary
Severity: critical — Confirmed exfiltration and publication of highly regulated payment card data (PAN, CVV, expiry dates, physical card scans) alongside PII (names, billing addresses) and reservation records constitutes a critical PCI-DSS and personal data breach affecting customers at scale.The Stormous ransomware group claims to have exfiltrated sensitive data including full reservation databases, booking platform references, payment card data (credit card numbers, expiration dates, and CVV codes), physical card scan images, and cardholder names and billing addresses. The disclosure status is listed as data_published, indicating the stolen data has been released.
Data the group says was taken
AI dossier — extracted from the leak post- Full reservation databases
- Booking platform references (including HeyTripGo)
- Credit card numbers
- Card expiration dates
- CVV codes
- Scans of physical card images
- Cardholder names
- Billing addresses
What the group claims
Full reservation databases Booking platform references (including HeyTripGo) Payment Data PDF files containing credit card numbers, expiration dates and CVV codes Scans of physical card images used in transactions Names and billing addresses linked to card...
Source
Indexed 19 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
