Desk live·
ForensicPost
Ransomware/Hospitality/File 24-0329

Daixin Claimed Omni Hotels Guest Records Going Back to 2017

Omni Hotels & Resorts was hit in late March 2024, taking reservation, door lock and payment systems offline. The Daixin Team claimed it held records on every guest since 2017.

Constructed geometry · not a chart of case data
JurisdictionUSAthe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetOmni Hotels & Resorts
ActorDaixin Team
D. Kennedy8 min readConfidence: medium1 source reviewed

Omni Hotels & Resorts was hit by a cyberattack in late March 2024. Reservation systems, hotel door locks and payment systems were affected. The Daixin Team claimed responsibility and said it held data covering Omni guests going back to 2017.

Seven Years Of Guests Is A Retention Decision

If the claim is accurate, the exposed population is not current guests. It is everyone who stayed across seven years, most of whom have no ongoing relationship with the chain and will not be expecting a notification from it.

This recurs constantly: Mr Cooper held every former mortgage customer, Neopets held accounts opened by children two decades earlier. Retention past the relationship converts a completed transaction into a permanent liability held on someone else’s behalf.

Door Locks Are On The Network

The reported effect on room locks is the detail worth keeping. A hotel’s physical access control is an IT system, and it fails when IT fails.

Graded medium: the seven-year claim originates with the operation that made it, and Omni has not published a record count or confirmed the scope.

How we reported this

Compiled from public reporting and the operation’s claims, listed below. The 2017 date and the scope of guest records are the attacker’s claim, not the company’s. No record count has been published. Corrections: corrections@forensicpost.com.

Sources
  1. Omni Hotels confirms cyberattack behind IT outageBleepingComputer
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary