Byod, a ransomware group that appeared this autumn, has added IHG Hotels & Resorts to its dark web leak site. IHG owns Holiday Inn, Crowne Plaza, InterContinental and Six Senses. The group says it got into IHG's network through an LDAP binding account whose password was "123". It claims to hold guest booking and loyalty data, complete employee personal data, AWS keys, full access to CyberArk, Active Directory access and "all financial records". IHG has not confirmed an incident. No regulator filing has been published, and no outlet has reported seeing sample data. For now this is a claim by a criminal group, not a confirmed breach. It still deserves attention: if any of it is true, guests at thousands of hotels across many brands could be affected.
What Happened
Ransomware trackers picked up the listing in the early hours of 4 November 2026. RansomLook recorded it at 00:21 UTC, and HookPhish logged its discovery about an hour later, at 01:26 UTC. HookPhish gives the breach date as 3 November. The entry names the victim as "IHG Hotels & Resorts (Estate)" and lists the country as the United Kingdom. ThreatMon also reported the listing. It is not clear what "Estate" refers to. It could mean IHG's whole corporate environment or a narrower entity such as a property-holding company or a single business unit.
The post itself taunts IHG over its password hygiene. It says that "rotating things won't really save you" because it is "not hard to hop back on your network". It names Six Senses, Holiday Inn, Holiday Inn Express, Staybridge Suites, Garner, Candlewood, Crowne Plaza and the Mayfair Hotel as affected brands. It ends with a demand that IHG use the site's contact tab, and says the group "will take you down" once the two sides are in contact. That wording reads as an extortion demand that has not yet turned into a negotiation.
Cyber Daily reports that IHG runs 69 hotels in Australia, which could be affected if the claim holds up.
The group's history is thin, and reports on it disagree. Cyber Daily says Byod emerged in September 2026 and has five alleged victims on its leak site. Orbitaley says it first posted a victim in October. RansomLook, as summarised by mAlice.ai, had recorded only two Byod listings when IHG appeared: Michigan State University on 2 November, then IHG. The Record has reported that the Michigan State post appears to match a real security incident that triggered campus-wide action. The Record also linked Byod to an October attack on the University of New Mexico. Orbitaley says the group first drew attention by leaking customer data from a US mobile virtual network operator. Media outlets verified part of that leak, but another group had claimed what appears to be the same intrusion a week earlier. So some of Byod's earlier claims have checked out, and at least one of its earlier victims was also claimed by another group.
IHG has been hit before. In September 2022, a cyberattack disrupted its booking systems and hurt business at franchised hotels. Computer Weekly reported that in that incident, attackers phished an employee and used destructive wiper malware. Orbitaley notes that news searches on IHG mostly return coverage of the 2022 attack. Nothing yet shows whether Byod is describing a new intrusion, reusing old material or exaggerating limited access.
What Was Taken
Everything below comes from the group's own leak-site post. None of it has been checked independently, and the group has given no record counts or data volumes.
- Guest booking data: guest name, billing address, company, rate code, room charges, taxes, spend, property and stay dates
- Folio and payment ledgers: guest name, address, phone, email, arrival and departure dates, rate and property
- Loyalty data: what the group calls "the loyalty data store", most likely tied to IHG One Rewards
- Employee data: what the group calls "complete employee PII"
- Cloud and identity access: AWS keys, "Full Access to CyberArk" and Active Directory access
- Finance: "All Financial Records"
The post does not mention payment card numbers. Even so, a dataset that links names, contact details, corporate affiliations, rates and exact stay dates would be very useful for targeted fraud. The claimed CyberArk and AWS access matters more to IHG and its partners than the guest data does. If it is real, the attackers would have had the keys to IHG's most privileged accounts, not just a copy of its data.
Why It Matters
Guest fraud follows hotel breaches. HIFY Radar warns that real folio and loyalty data would allow convincing booking-themed phishing and theft of loyalty points across IHG's brands. Criminals already pose as hotels to send fake "confirm your card" messages. With real stay dates and rate codes, those messages become much harder to spot.
The claim is really about identity infrastructure. Byod says it controls Active Directory and CyberArk. If true, changing passwords would not remove the attackers, which is exactly what the group boasts. Taking back control would mean rebuilding trust in the directory and the privileged-access vault themselves.
Third parties are exposed too. Analysts at F4N6 point out that organisations whose systems connect to IHG's booking, loyalty or corporate-travel services should treat the claim as a possible third-party credential compromise. For EU financial firms, that falls under DORA Article 28 (ICT third-party risk) and NIS2 Article 21(2)(d) (supply-chain security). The direct risk is low unless a firm holds IHG data or connects to IHG systems.
Small groups can do large damage. Byod has only a handful of listings, but at least one earlier claim lines up with a confirmed incident. Its size is no reason to dismiss it.
The Attack Technique
According to the group, the way in was an LDAP binding account protected by the password "123". Applications and appliances use binding accounts to query a directory. These are service accounts that are often created once, given broad read rights and then forgotten. An attacker with valid bind credentials can list users, groups, service accounts and privileged role memberships across the domain. That map makes it easy to find routes to domain admin and to privileged-access tools such as CyberArk.
Orbitaley reports that Byod has described its usual methods as stealing credentials from supplier employees with infostealer malware and abusing accounts that lack multi-factor authentication. That fits the LDAP story: a simple stolen or guessed credential, followed by abuse of the identity system. No one has published an analysis of Byod's encryptor or tools, the group has no MITRE ATT&CK profile, and no CVE has been linked to this claim. No one has reported whether any IHG systems were encrypted.
What Organizations Should Do
- Audit LDAP bind and service accounts now. List every account used for LDAP binds. Enforce long, random passwords managed through a vault. Restrict each account to the hosts that need it, and turn off anonymous and simple binds over unencrypted LDAP. Require LDAP signing and channel binding.
- Plan for directory compromise, not just password resets. If an attacker may have controlled AD, prepare for double KRBTGT resets and review of AdminSDHolder, GPOs, delegation settings and new or changed privileged accounts. Assume persistence until you have proven otherwise.
- Treat CyberArk and cloud keys as a single trust boundary. Rotate vaulted credentials from a known-clean admin path. Audit CyberArk for unusual retrievals and policy changes. Rotate AWS access keys and review CloudTrail for new IAM users, roles, access keys and unusual API calls.
- Hunt for infostealer exposure among suppliers. Byod says it targets supplier staff. Check infostealer log feeds for credentials tied to your domains and your vendors' access. Make MFA mandatory on all remote and third-party access.
- If you depend on IHG, check your exposure. Corporate travel managers and firms connected to IHG's booking or loyalty platforms should review what data they share and what integration credentials exist. Prepare to rotate those credentials.
- Warn travellers. Tell staff and customers who stay at IHG properties to expect reservation-themed phishing. They should never re-enter card details from an unsolicited message, and they should watch their IHG One Rewards accounts and add extra login protection where IHG offers it.
Sources: Byod Ransomware Group Claims Compromise of IHG Hotels & Resorts via... | Exclusive: Dozens of Australian hotels potentially impacted by alle... | Group byod claims breach of IHG Hotels network HIFY Radar | Byod ransomware group claims attack on IHG Hotels & Resorts · Orbit... | Byod claims attacks on Michigan State University and IHG Hotels & R... | BYOD Claims IHG Hotels & Resorts (Estate) as New Ransomware Victim... | IHG Hotels and Resorts (Estate) Data Breach: Byod Ransomware Claim... | BYOD claims IHG Hotels breach exposing AWS keys and CyberArk access