IHG Hotels & Resorts Breach Claim
| Company | IHG Hotels & Resorts (Holiday Inn, Crowne Plaza, Six Senses and more) |
|---|---|
| Claimed by | BYOD hacking group |
| Claim posted | November 3, 2026 |
| Data claimed | Guest booking records, loyalty data, employee information, financial records |
| Confirmed by IHG | No |
| Lawsuit filed | Not yet |
A hacking group called BYOD says it breached IHG Hotels & Resorts and stole guest booking records, loyalty program data and employee information, Australian security outlet Cyber Daily reported on November 4, 2026. IHG, which runs brands including Holiday Inn, Holiday Inn Express, Crowne Plaza and Six Senses, has not confirmed any breach, and the hackers have not published proof.
What the hackers claim
In a post on its leak site dated November 3, 2026, BYOD claimed it had obtained:
- Reservation and payment ledgers with guest names, addresses, phone numbers, emails, stay dates, rates and the hotel booked
- IHG’s loyalty program data store
- Complete employee personal information
- Financial records and access to internal systems
The group named brands including Holiday Inn, Holiday Inn Express, Staybridge Suites, Candlewood, Garner, Crowne Plaza and Six Senses. None of these claims has been independently verified.
How much weight to give the claim
BYOD only appeared in September 2026 and lists five alleged victims, according to Cyber Daily. Some of its earlier claims appear genuine, while it withdrew at least one and apologized. Hacker groups often exaggerate what they took to pressure companies into paying, so a leak site listing is a warning sign rather than proof.
IHG has dealt with a cyberattack before. In September 2022, the company told the London Stock Exchange that unauthorized activity had disrupted its booking systems for days.
What IHG guests can do now
Until IHG says more, guests and IHG One Rewards members can take a few simple steps. Change your IHG account password and any other account that uses the same one, watch for phishing emails that mention a recent stay or your points balance, and check card statements for charges you do not recognize. If IHG confirms a breach, it will have to send notice letters and report to state regulators, and a data breach lawsuit usually follows within days. Our guide on how class actions work explains what happens next.
Frequently asked questions
Did IHG have a data breach in November 2026?
Not confirmed. A hacking group claimed a breach on November 3, 2026, but IHG has not confirmed it and no data has been verified.
Which hotel brands are named in the IHG breach claim?
The hackers named Holiday Inn, Holiday Inn Express, Staybridge Suites, Candlewood, Garner, Crowne Plaza, Six Senses and the Mayfair Hotel.
Is there an IHG data breach lawsuit?
Not yet for this claim. Lawsuits usually follow once a company confirms a breach or sends notice letters.
