cyfenced.com →

[ Ransomware claim · safepay · 28 Sep 2026 ]

Holiday Inn Vilnius

The ransomware group safepay named Holiday Inn Vilnius (Lithuania) on its leak site on 28 Sep 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.

Confirmed by the organisation Hospitality

[ Status ]Has the attack been confirmed?

In early October 2026 LRT reported that the hotel said it was taking the situation very seriously, had acted from the start and was cooperating with Lithuanian and international institutions while a criminal pre-trial investigation is under way.

[ The organisation ]Who is Holiday Inn Vilnius?

What it does
Holiday Inn Vilnius is a hotel in central Vilnius operating under the IHG Holiday Inn brand. It offers guest rooms, the Rib Room restaurant, a sauna and meeting facilities. Lithuanian press reports that the hotel is operated by the company Valmeda.
Based in
Šeimyniškių 1, Vilnius, Lithuania
Founded
2002
Size
134 rooms over seven floors
Who it serves
The hotel serves business and leisure travellers visiting Vilnius, including international guests, as well as diners at its restaurant and organisers of meetings and events.

Partners and customers it names publicly

  • IHG Hotels & Resorts, Brand under which the hotel operates (Holiday Inn)
  • Valmeda, Company reported by LRT as the hotel's operator

[ Impact ]Who could be affected

Guests who stayed at the hotel could have their booking and identity details exposed, which could lead to targeted phishing or fraud attempts. Staff could also be affected, and bookings, check-in or restaurant services could be disrupted while systems are checked.

In hospitality generally: Guests can face booking problems and phishing that uses their reservation details, and hotels and restaurants hold names, contact details and payment data.

[ The attacker ]About safepay

SafePay is a ransomware group that security researchers describe as running its own attacks rather than using affiliates. It usually gets in through stolen credentials for remote access services such as VPN and RDP, copies data and then encrypts systems, threatening to publish the data if no ransom is paid.

safepay has claimed 22 organisations in the last 30 days, most in Germany, United States and Belgium, and mostly in other, hospitality and education. We wrote about the group in Fifty victims in a day, two hosting breaches and town halls offline.

safepay on Ransomware.live

Other organisations safepay has named

[ What to do ]If you are a customer, partner or neighbour

  1. If you stayed at the hotel in 2026, watch for emails, messages or calls that mention your stay or ask for payment or card details, and verify them directly with the hotel.
  2. Check your bank and card statements for unfamiliar charges and contact your bank if anything looks wrong.
  3. Be cautious of anyone claiming to be from the hotel or IHG who asks you to confirm passport or personal details.
  4. Keep an eye out for any notice from the hotel or the Lithuanian State Data Protection Inspectorate about who is affected.
Researched with AI from the sources on this page on 26 Oct 2026. Facts can change: check the organisation's own announcements.