Are New Zealand Hotels Potential Victims of IHG Hotel Breach?

Threat actor group Byod has listed IHG Hotels & Resorts on its dark web leak site, claiming to have compromised the international hotel group’s network and obtained significant volumes of sensitive corporate, employee and customer information.

In its published statement, Byod claims to have gained access through an LDAP binding password of 123, suggesting potentially weak authentication controls may have played a role in the alleged compromise.

The group claims to have obtained a substantial collection of information, including:

• Customer personal information and complete employee PII.
• AWS keys and access to CyberArk.
• Active Directory access.
• Guest booking and reservation information, including names, billing addresses, email addresses and phone numbers.
• Property and stay dates, room charges, taxes, company details and rate codes.
• Loyalty programme data.
• Reservation and payment ledgers.
• Corporate financial records.

Byod specifically references several IHG brands allegedly affected, including Six Senses, Holiday Inn, Holiday Inn Express, Staybridge Suites, Garner, Candlewood, Crowne Plaza and Mayfair Hotel.

The group has also threatened to publish or otherwise release the information if communication with IHG is not established.

IHG has not publicly confirmed a cyber incident, and the threat actor’s claims and purported stolen data have not been independently verified. It is therefore not currently possible to establish the accuracy or extent of the alleged compromise.

Potential implications for New Zealand and Australian hotels

While it remains unknown whether New Zealand or Australian operations have been affected, the claims are particularly relevant to both countries given IHG’s substantial accommodation footprint across the region.

New Zealand has numerous accommodation providers operating under the IHG umbrella, including:

The potential exposure of booking information is particularly concerning for the hospitality industry. Guest names, contact details, accommodation dates and property information can provide criminals with everything needed to construct convincing, highly targeted phishing campaigns.

For example, criminals could impersonate hotel staff, reservation platforms or payment providers, contacting guests with legitimate-looking booking references and accommodation details to request additional payments or payment card information.

If the claims around Active Directory, CyberArk and AWS access are accurate, the incident could also represent a much broader corporate security concern beyond customer data, potentially involving privileged credentials, cloud infrastructure and internal financial information.

Australian IHG properties could face similar concerns, although the extent of any regional impact remains unknown.

For now, the Byod listing should be treated as an unverified threat actor claim rather than confirmation of a breach. However, given the potential sensitivity of the information described, IHG customers and regional accommodation operators will be watching for further developments.

About Byod

Byod is a relatively new ransomware/extortion actor, first observed on 29 September 2026. Despite its short operational history, the group has already listed 14 victims on its dark web leak site. At least two organisations have acknowledged being compromised, lending some credibility to the group’s claims. However, evidence surrounding Byod’s broader victimology, initial access techniques and technical tooling remains limited. Further monitoring will be needed before any meaningful patterns emerge regarding its targeting, capabilities or operational relationships.