Cheval Blanc Randheli Listed by Aurora Ransomware Group

On April 22, 2026, the luxury resort Cheval Blanc Randheli appeared on the leak site of the aurora ransomware group, exposing 75,855 passport scan images collected over ten years.

What Public Reporting Shows

Public reporting indicates the data was stolen during a ransomware attack on systems linked to LVMH, the parent company of Cheval Blanc. The files cover the period from January 2015 through October 2024 and are stored in daily folders organized by month and year. Each image shows the full passport bio page, including the guest’s photograph, full name, date of birth, nationality, passport number, machine-readable zone (MRZ), and signature.

Estimates based on available reporting suggest the scans relate to 20,000–30,000 unique guests. Among the exposed records are nine passport scans belonging to members of the Qatar Royal Family, including individuals named Muhammad Mesned S M Al-Misned, Abdulla, Khalifa, Lolwa, Nasser, Alanoud, and Bes. The exact number of ordinary guests affected remains unknown, but the volume points to a significant breach of high-value personal documents.

Why This Matters for You and Your Family

Passport scans contain some of the most sensitive identity details a person can possess. With your photo, full name, date of birth, passport number, and MRZ all in one file, criminals gain everything needed to attempt identity theft, open fraudulent accounts, or impersonate you when traveling. If you or anyone in your family stayed at Cheval Blanc Randheli or any LVMH property during the past decade, your information may now be in the hands of ransomware operators who routinely sell or publish stolen data.

Children’s records are also at risk when families travel together. A minor’s passport scan can be combined with other leaked details to build long-term identity profiles that follow them into adulthood. Ordinary travelers who simply enjoyed a luxury holiday now face the same exposure as high-profile guests.

The Doxxing and Identity-Chain Implications

Once passport data appears in criminal circles, it rarely stays isolated. Attackers combine it with usernames, email addresses, phone numbers, and gaming handles found in other breaches to create detailed identity chains. A single reused password or linked social-media account can let criminals move from a ten-year-old passport scan to control of your current email, bank accounts, or online profiles.

Credential leaks like this one cascade into account takeovers and doxxing chains. Gaming accounts belonging to you or your children are especially vulnerable because they often share the same email address or password patterns used for travel bookings. What begins as a hotel breach can quietly escalate into harassment, extortion demands, or full identity compromise months or years later.

Aurora Ransomware Group Track Record

Public reporting attributes the attack to the aurora ransomware group. The group emerged in recent years and has targeted a range of organizations, with a focus on companies that hold valuable customer or internal data. Their typical playbook involves gaining initial access, exfiltrating sensitive files, and then publishing samples on their leak site when victims do not meet extortion demands. In this case they listed Cheval Blanc Randheli on their onion site, making portions of the stolen passport data publicly visible to anyone who visits the address.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you is caught in hours rather than months.
• Rotate the password you used when booking or checking in at Cheval Blanc Randheli anywhere it is reused, and switch on 2FA through an authenticator app instead of text messages.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that chain back to the same address or email.
• Let remediation specialists handle takedown requests across data brokers and exposed records for you while you focus on securing daily life.

The incident shows how quickly travel records can become lifelong liabilities in an era when ransomware groups publish millions of files without warning. Taking concrete steps now can limit the damage and reduce the chance that this claimed breach becomes the first link in a larger chain of identity abuse. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.