The ransomware group known as BYOD claims it has stolen customer, employee and booking data from IHG Hotels & Resorts, the UK-headquartered company behind Holiday Inn, Crowne Plaza and InterContinental. IHG has not confirmed any breach, and the gang has published no evidence to back up its claim, according to Cyber Daily, which first reported the listing.

BYOD posted IHG on its dark web leak site on 3 November, then issued a "first and final warning" listing on 5 November. The group alleges it gained access through a weak LDAP binding password and claims to hold guest names, billing addresses, booking and payment records, loyalty programme data, AWS keys, full access to the CyberArk privileged-access system, Active Directory access and complete employee personal information. It says the alleged compromise affects brands including Six Senses, Holiday Inn, Holiday Inn Express, Staybridge Suites, Garner, Candlewood, Crowne Plaza and the Mayfair Hotel.

IHG operates more than 6,800 leased and franchised hotels worldwide, including 69 in Australia. Cyber Daily estimates that a full compromise of employee data could affect more than 380,000 people. The gang has since removed the IHG listing from its leak site, and it is not yet clear whether BYOD is alleging a new intrusion or recycling older material: IHG's only widely reported cyber incident to date was a separate attack in September 2022 that disrupted its booking systems.

BYOD only emerged in September 2026 but has moved quickly. It previously claimed Michigan State University and disrupted the University of New Mexico hospital system. Until IHG confirms an incident or evidence appears, the claim should be treated as an allegation, not a confirmed breach.