Byod ransomware group claims attack on IHG Hotels & Resorts
Byod, a ransomware-as-a-service operation that emerged in October 2026, has listed UK-based hotel company IHG Hotels & Resorts among its victims. The claim is unverified, and the available press coverage refers to a separate cyberattack the company suffered in September 2022.
What happened
On 4 November 2026, the Byod group claimed an attack on IHG Hotels & Resorts, a hotel company headquartered in the United Kingdom, on its leak site. The available data does not specify what information the group says it obtained or when the alleged intrusion took place.
The news reports linked to the victim, from TechCrunch, BleepingComputer, Computer Weekly, The Wall Street Journal, CoStar, Travel Weekly and Malwarebytes, date from September 2022. They describe a cyberattack that disrupted IHG's booking systems at the time and hit business at franchised hotels. According to Computer Weekly, the attackers in that incident phished an employee to deploy a destructive wiper.
Byod did not post its first victim until October 2026, so those reports do not confirm the new claim. It is unclear whether the group is taking credit for the 2022 incident, alleging a new intrusion, or recycling old data.
Who the group is
Byod is a very recent ransomware-as-a-service (RaaS) operation. It first drew attention by leaking customer data from a US mobile virtual network operator, part of which was verified by media outlets. The company has not formally acknowledged the breach, and another group had claimed what appears to be the same intrusion a week earlier.
According to the group itself, it gains access by stealing credentials from supplier employees with an infostealer and exploiting accounts without MFA (multi-factor authentication). There is no independent technical analysis of its encryptor or tools. In late October 2026 it claimed an attack on an academic health sciences centre in New Mexico (US), although attribution is unconfirmed. Based on its leak site, it lists victims in telecommunications, healthcare, education, professional services, finance and retail, in countries including the United States and Malaysia.
What organisations can do
The most useful measures target the group's claimed entry method: stolen credentials and accounts without MFA.
- Enforce MFA on all remote access, VPNs and cloud services, including supplier accounts.
- Review and restrict third-party access, using individual accounts, least privilege and immediate revocation when contracts end.
- Deploy endpoint protection able to detect infostealers and monitor for corporate credentials appearing in leaks.
- Train staff against phishing, a technique already used against the hotel sector.
- Keep offline, tested backups, which help against both ransomware and wipers.
Sources
About the group: Byod
Get the alerts
Relevant vulnerabilities, notable ransomware victims, new groups and the weekly bulletin, as soon as they are published.
Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.