Ransomware victim disclosure
← All victimsAman Resorts (aman.com)
Claimed by shinyhunters · listed 1 month ago
Status timeline
- Listed
Apr 19, 2026
- Data leaked
At a glance
- Group
- shinyhunters
- Status
- Data leaked
- Country
- SG
- Sector
- Hospitality and Tourism
- Listed on leak site
- Apr 19, 2026
About the victim
AI dossier — public-source company profileAman Resorts is a Singapore-headquartered ultra-luxury hospitality group operating 35 hotels, resorts, and residences across 20 countries worldwide, spanning the Americas, Europe, Middle East, Africa, and Asia. The group also encompasses branded residences, private villas, wellness programmes, and a fleet vessel (Amangati). Aman is known for its exclusive, small-capacity retreats catering to high-net-worth travellers.
- Industry
- Luxury Hospitality & Resorts
- Employees
- 1001-5000
- Founded
- 1988
Attack summary
Severity: critical — Confirmed exfiltration of over 500,000 PII-containing CRM records at scale from a luxury hospitality operator whose guest base is predominantly high-net-worth individuals, representing significant regulated personal data exposure; status is 'data_published' indicating the threat has materialised or is imminent.ShinyHunters claims to have exfiltrated over 500,000 Salesforce records containing personally identifiable information from Aman Resorts, issuing a final ransom ultimatum with a deadline of 21 April 2026 before publishing the data and causing additional unspecified 'digital problems'.
Data the group says was taken
AI dossier — extracted from the leak post- Salesforce CRM records
- Personally identifiable information (PII)
- Customer contact data
- Potentially guest reservation and loyalty data
What the group claims
Over 500k Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 18 Apr 2026 | Warning: FINAL WARNING PAY OR LEAK
Sources
- Victim siteaman.com
Source
Indexed 1 month agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
