CryptoRex breaches Arkın hotel chain, leaks 1.4TB

Threat group CryptoRex stole 1.4TB from Arkın Group hotels in Cyprus, exposing guest profiles, casino patron data, and financial records via compromised employee credentials.

The Arkın Group hotel chain in Northern Cyprus has suffered a significant data breach affecting its premium properties including The Arkın Colony, The Arkın Iskele, and Arkın Palm Beach. Attackers attributed to the CryptoRex threat group gained initial access through a compromised employee account in the reservations department, then used legitimate remote administration tools to escalate privileges and exfiltrate approximately 1.4 terabytes of sensitive data.

The stolen data encompasses full guest profiles with passport details and stay history, financial booking information, the internal CRM system with VIP client notes, and critically, the casino database containing player identities, deposit amounts, transaction records, and KYC/AML compliance documents. Portions of the stolen data have already appeared on underground forums, with archives being auctioned starting at 8 bitcoins. The breach poses substantial risks including targeted extortion of high-net-worth casino patrons, financial fraud, regulatory scrutiny over data protection failures, and potential money-laundering investigations given the exposure of AML records.

CryptoRex has been tracked since 2023 and specializes in targeting hospitality and gambling businesses in the Mediterranean region. The group's modus operandi combines financial extortion with data sale to multiple buyers. Cyclops Threat Intelligence has urged all past guests and casino visitors to immediately reissue payment cards, monitor credit reports, and remain vigilant against targeted phishing attacks leveraging the leaked contextual information.

Source reporting: https://www.ransomware.live/id/QXJraW4gR3JvdXBAYmxhY2tuZXZhcw==