Indian online travel company Yatra.com has been listed as a victim by the LockBit 5 ransomware group, according to leak-site records published on 9 November 2026. The listing appeared on the group's leak site on 8 November, and was picked up by threat-intelligence trackers overnight.

Yatra, based in Gurugram, India, runs an online travel platform selling flights, hotels and holiday packages. The leak-site post gives no ransom figure and no description of how the group says it got in, and it does not state whether systems were encrypted or data was taken.

Infostealer data behind the claim

Separate intelligence linked to the incident paints a picture of extensive credential exposure. Figures reported by Hudson Rock, a cybercrime intelligence firm, show 34 Yatra employees compromised, along with 43 third-party employee credentials and 24,829 user accounts.

The same reporting counts 84,364 exposed passwords, 360 of them classed as critical, and 15,316 exposed cookies, 372 of them critical. The company's external attack surface was measured at 117 points, with cloud and software services including Google Workspace, Microsoft 365, MongoDB, Brevo and Zoho Campaigns in use.

An unverified claim, for now

Threat-intelligence firm ThreatMon also reported the listing on 8 November, and a second tracker reproduced the leak-site post, dated 8 November, in a record published at 00:19 UTC on 9 November. Neither source provides technical evidence of an intrusion, data samples or confirmation from Yatra itself.

That matters because ransomware listings are claims made by criminals to force payment. A listing alone does not prove that Yatra's systems were breached, that customer booking data was stolen, or that any traveller's personal or payment details are at risk.

LockBit 5 and the wider picture

LockBit 5 is the latest iteration of the LockBit operation, one of the longest-running ransomware brands. The Yatra listing is one of several new LockBit 5 claims this month, alongside a Brazilian firm, Grupo Telles, and a Thai furniture retailer, both listed on 8 November.

November has been a busy month for ransomware claims overall. Trackers record 275 victims named on leak sites in the first nine days of the month, against 1,147 across the whole of October.

What Yatra customers should do

Until Yatra confirms or denies the claim, customers should treat it as a warning rather than a confirmed breach. Anyone with a Yatra account should change its password, switch on two-factor authentication, and use a different password from any other service. The exposed infostealer data suggests stolen logins, rather than a direct break-in, may be how the attackers gathered their material.