Cl0p Ransomware Gang Claims Breach of Hilton, Allegedly Stealing 48.5GB of Data The Russia-linked ransomware group Cl0p has added Hilton, one of the world’s largest hotel chains, to its dark web leak site, alleging a successful cyberattack. The claim, posted on January 25, lists hilton.com as the latest victim, though no independent verification or data samples have been provided to confirm the breach. Cl0p, known for its double-extortion tactics, typically steals and encrypts victim data, then threatens to publish it unless a ransom is paid. In this case, the gang claims to have exfiltrated 48.5GB of documents from the Hyatt Place Chelsea New York hotel, making the data publicly accessible for download. The group’s unusual communication style posting demands on its dark web blog rather than contacting victims directly may stem from being overwhelmed by the volume of attacks. Hilton, which operates over 600 properties across 94 countries and boasts 195 million loyalty program members, represents a high-value target due to its vast trove of customer and corporate data. Ransomware groups often calculate demands based on a victim’s revenue, with initial ransom requests ranging from 0.05% to 5% of annual earnings Hilton reported $11.7 billion in revenue in 2023. While Cl0p has a history of high-profile attacks, including breaches of file transfer platforms that impacted thousands of organizations, Hilton has not publicly confirmed the incident. The gang’s claims remain unverified, and no details about the type of data allegedly stolen have been disclosed. This follows a recent ransomware attack on another U.S. hotel chain, underscoring the growing threat to the hospitality sector. Despite a 2021 law enforcement crackdown, Cl0p has resurged, operating under a ransomware-as-a-service (RaaS) model, where affiliates deploy its malware in exchange for a cut of ransom payments.