On 8 November 2026, the LockBit 5.0 ransomware group added Yatra.com to its leak site. Yatra is a Gurugram-based online travel company whose parent is listed on NASDAQ. The group's claim has not been verified. Yatra has not publicly linked LockBit to any incident and has not confirmed that data was stolen. Six days before the listing, however, Yatra Online Limited told Indian stock exchanges it had suffered a cyber security incident. Several reports say more than 24,000 user credentials were exposed. That figure comes from infostealer telemetry, not from any data the group has shown it stole. The difference matters, and this brief explains it below.
What Happened
Yatra's own disclosure is the most authoritative record. On 2 November 2026, Yatra Online Limited filed an "Intimation of Cyber Security Incident" under Regulation 30 of SEBI's Listing Obligations and Disclosure Requirements rules. The Economic Times lists the filing. According to Whalesbook's summary, the company told the BSE and NSE the following:
- The incident had no material impact on its core operations or financial performance.
- It had notified CERT-In, India's national computer emergency response team.
- It had started remediation and a forensic assessment.
Whalesbook also reports no sign of disruption to customer services or booking platforms.
The LockBit listing came on 8 November. RansomLook recorded it that day, according to Vulnpocalypse. ThreatMon also flagged the listing, according to Undercode News. Trackers give slightly different times for it:
- HookPhish puts the claimed breach date at 11:16 UTC and its own discovery at 23:30 UTC.
- DayBreach logs the announcement at 13:25, with an update later that day. It does not give a time zone.
No tracker reports a data sample, a file size or a ransom deadline. DayBreach lists the data size and file count as unknown. Vulnpocalypse notes that it could retrieve only the headline of the listing.
The timing is suggestive, but nobody has shown that the 2 November incident and the 8 November claim are the same event. Yatra has not named an attacker, and LockBit has not published evidence.
What Was Taken
Nothing has been confirmed. Several different figures are circulating, and they describe different things.
The 24,000+ credential figure. QPulse reports that 24,829 Yatra user accounts were compromised, along with credentials for 34 employees and 43 third-party staff. QPulse attributes these numbers to Hudson Rock. Hudson Rock collects data from infostealer malware, which steals saved logins from infected personal and corporate devices. Its figures count devices where someone had saved a yatra.com login. They do not count records taken from Yatra's servers. QPulse also cites 84,364 exposed passwords (360 marked critical), 15,316 cookies (372 critical) and an external attack surface of 117. QPulse presents these alongside the LockBit listing. No source shows that LockBit took this data or used it.
The 5.39 million record figure. HEROIC reported in October 2026 that it had found a file of 5,391,062 Yatra customer records. The file includes emails, names, phone numbers and plaintext passwords, and it is dated 1 September 2013. This is a separate, much older dataset. It is not evidence of what LockBit may hold.
What LockBit has shown. No samples have been reported. If the claim is genuine, the data at risk could include customer records, booking details and internal corporate information, as Undercode News notes. That remains speculation until data is published or Yatra says more.
Why It Matters
Yatra holds identity and travel data for a large Indian customer base. Names, phone numbers, itineraries and payment-linked bookings are ideal material for convincing phishing and phone scams. That risk holds whether or not the LockBit claim proves true.
The infostealer data deserves attention on its own. Stolen employee and contractor logins are one of the most common ways ransomware crews get into networks. QPulse says Yatra uses Google Workspace, Microsoft 365, MongoDB, Brevo and Zoho Campaigns. Stolen session cookies for single sign-on and SaaS platforms can let an attacker bypass multi-factor authentication entirely.
The case also shows how the LockBit brand has recovered. DayBreach describes LockBit 5.0 as follows:
- It appeared in September 2025, after the February 2024 law enforcement takedown of the group.
- It runs payloads for Windows, Linux and VMware ESXi.
- It keeps the affiliate model of earlier versions, in which independent operators carry out attacks under the LockBit name.
DayBreach counts about 195 victims listed by the group. Leak-site listings from this operation should be taken seriously, but they are not proof on their own.
The Attack Technique
The way in is unknown. Yatra's filing does not describe the intrusion, and LockBit has not said how it gained access. QPulse states that its source does not identify the entry point.
The infostealer exposure Hudson Rock reports fits the pattern seen in many LockBit affiliate intrusions. Typically, an affiliate buys or reuses valid employee or contractor logins and then logs in through VPN, remote access or SaaS portals. That is a plausible path here, not a confirmed one. If LockBit 5.0 ransomware was deployed, its ESXi support would put virtualisation hosts at particular risk. No report says encryption took place, and Yatra says operations were not materially affected.
What Organizations Should Do
- Treat infostealer exposure as a live breach. Check commercial infostealer feeds for your domains. Force password resets and revoke sessions for every exposed employee and contractor account, including third-party staff.
- Revoke tokens as well as passwords. Stolen cookies stay valid after a password change. Revoke active sessions and OAuth tokens in Google Workspace, Microsoft 365 and other SaaS platforms. Shorten session lifetimes for admin roles.
- Use phishing-resistant MFA on remote access. Require FIDO2 keys or passkeys for VPN, remote desktop, cloud consoles and database admin access. Block legacy authentication.
- Harden ESXi and backups. Take ESXi management interfaces off general networks. Turn on lockdown mode and keep offline or immutable backups, since LockBit 5.0 targets hypervisors directly.
- Warn customers about scams that use this incident. Travel and e-commerce firms should expect fraudsters to impersonate them in booking, refund and "account security" messages. Publish official contact channels.
- If you are a Yatra customer, change your Yatra password and any other password you reused with it. Be suspicious of unexpected calls or messages about bookings or refunds. Watch Yatra's exchange filings for updates on the forensic assessment.
Sources: Lockbit5 Ransomware Group Targets Yatra.com, Exposing Over 24,000 U... | Yatra Online News - Yatra Online Announcement, Latest News on Yat... | LockBit 50 Claims Yatra and WhiteArmor Claims Colombian Healthcare... | Yatra Breach Exposes 5,391,062 Customer Records Now HEROIC | Yatra Online Reports Cyber-Security Incident; No Material Impact on... | LockBit5 claims yatra.com on ransomware leak site Vulnpocalypse | yatra.com Data Breach: Lockbit5 Ransomware Claim (Nov 2026) | yatra.com ransomware leak · Lockbit5 · DayBreach