H-Hotels cyber attack claimed by Play ransomware

On Sunday 11^th of December 2022, a German hotel chain, H-Hotels experienced a cyber attack that resulted in their IT systems being immediately shut down and disconnected from the Internet in order to stop further spread. Although the attack did not impact guests’ bookings, hotel staff were not able to receive or answer customer requests sent via email.

“According to the first findings of internal and external IT specialists, cybercriminals managed to break through the extensive technical and organizational protection systems of IT in a professional attack,” – The H-Hotel’s security incident notice.

The hotel chain has stated they have informed the German investigative authorities of the incident and is working with an IT forensics firm to restore systems as quickly as possible. H-Hotels also states that they are ensuring they will be adequately protected against similar cyberattacks in the future. The Play ransomware gang has claimed the cyber attack when they listed the hotel chain on their Tor site today where they claimed to have stolen private and personal data, including client documents, passports, IDs, and more. However, H-Hotels has denied these claims as they stated that their commissioned IT forensic specialists have seen no evidence that any data could be stolen during the cyber attack.