Ransomware victim disclosure
← All victimsSheraton Hotels and Resorts
listed as Sheraton Hotel · Claimed by worldleaks · listed 2 months ago
Status timeline
- Listed
Mar 27, 2026
- Data leaked
At a glance
- Group
- worldleaks
- Status
- Data leaked
- Country
- United States
- Sector
- Hospitality and Tourism
- Listed on leak site
- Mar 27, 2026
About the victim
AI dossier — public-source company profileSheraton Hotels and Resorts is a global luxury hospitality brand owned by Marriott International, founded in 1937. It operates hundreds of hotels, resorts, and residential properties worldwide, serving both leisure and business travelers. Its properties commonly feature conference facilities, fitness centers, and dining services across numerous countries.
- Industry
- Hospitality & Hotel Management
- Employees
- 10000+
- Founded
- 1937
Attack summary
Severity: medium — Data is marked as published, indicating at least some exfiltration claim against a major global hospitality brand that likely holds guest PII, payment data, and loyalty program information; however, the leak post contains no specifics on data type, volume, or proof files, limiting severity assessment.The group worldleaks claims to have published data belonging to Sheraton Hotels and Resorts, with the disclosure status recorded as data_published. No specific details about the nature of the exfiltrated data, encryption activity, or ransom demand are provided in the leak post.
Original description
AI-summarised, not from the leak postSheraton Hotels and Resorts, founded in 1937, is a global hospitality brand owned by Marriott International. It operates luxury hotels, resorts, and residential establishments globally, known for providing high-quality services and amenities. Its properties often offer conference facilities, meeting rooms, fitness centers and occasionally dining services, serving both leisure tourists and business travelers.
Sources
Source
Indexed 2 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
