What happened
In April 2025 The Fullerton Hotels and Resorts confirmed that its Sydney property had been hit by a ransomware attack on 24 March 2025, after the Akira ransomware group listed the hotel on its dark-web leak site [full-cyberdaily]. The hotel confirmed that an unauthorised person had gained access to and exfiltrated employee records and the credit-card details of a small number of guests [full-cyberdaily]. Akira separately claimed to have taken more than 148 GB of data, including passports, driver licences, other employee and customer documents, financial data, NDAs and contracts [full-cyberdaily]. The hotel said its Singapore and Hong Kong properties were not affected [full-cyberdaily].
Timeline
- 2025-03-24 — Ransomware attack, per the hotel [full-cyberdaily].
- 2025-04-08 — Akira posted the hotel to its leak site [full-cyberdaily].
- 2025-04-09 — The hotel issued an update confirming the incident and said it had notified the OAIC [full-cyberdaily].
Current status
Disclosed. The hotel confirmed the breach and said it had reported it to the Office of the Australian Information Commissioner and would cooperate [full-cyberdaily]. No regulator investigation has been reported. The 148 GB volume and the additional data categories (passports, driver licences and others) are the attacker’s claims and have not been independently confirmed; no count of affected individuals has been published, so none is asserted here.
Why it matters
Hotels collect passports and payment cards at check-in, making them a rich target — and this record keeps the company’s confirmed facts (employee records and some guests’ card details taken; the regulator notified) separate from the ransomware group’s unverified claims about what else was taken.