Yatra · Breach

[Single source] LockBit 5.0 lists Indian travel platform Yatra on leak site

Nov 10, 2026 · 1 min read

The LockBit 5.0 ransomware operation listed Yatra, the Gurugram-based Indian online travel platform, on its data-leak site. No data volume or samples have been verified and Yatra has not confirmed an incident; separately reported infostealer data includes thousands of user logins and employee credentials. Users should rotate passwords and enable two-factor authentication.

By HIFY Radar newsroom Updated 11/10/2026 04:23 AM Get this every day →← Back to the feed 1 source

LowBreachNo software to update

In 30 seconds

Observed

The LockBit 5.0 ransomware operation has listed Yatra, the Gurugram-based Indian online travel company behind yatra.com, on its data-leak site, the public page ransomware crews use to pressure victims. That listing is the hard fact of the moment. Everything beyond it, from stolen data to an actual breach inside Yatra, remains a criminal claim rather than a verified event.

Alleged

No data volume or samples have been verified, and Yatra has not publicly confirmed any incident. Separately, infostealer data, meaning logs harvested by password-stealing malware, reportedly includes thousands of Yatra user logins and some employee credentials. The practical takeaway for users is simple: change your Yatra password and turn on two-factor authentication.

What happened

Observed

According to a post from threat intelligence account DailyDarkWeb, the rebuilt LockBit 5.0 operation added Yatra to its data-leak site. The listing names yatra.com, the online travel platform headquartered in Gurugram, India. Seeing a company named on such a page is a demand for payment, not proof that data was taken.

Alleged

DailyDarkWeb's analyst note adds a second strand: separate infostealer data reportedly holds thousands of Yatra user logins along with some employee credentials. The word to watch is reportedly, because no sample has been independently checked.

Inferred

The note describes stolen credentials as a common entry path for ransomware, which hints the infostealer logs and the leak-site listing could be connected. For now that connection is a hypothesis, not a demonstrated chain of events.

Why it matters

Inferred

LockBit's rebuilt 5.0 operation has been relisting victims at a steady pace, so a fresh name on the site signals the group's extortion machinery is running again and still choosing targets. A travel platform used by many people fits the pattern of high-visibility victims chosen for leverage.

Inferred

If the reported credential logs are real, thousands of travelers and some staff would have exposed login details. That is exactly the kind of access that enables account takeover, where criminals walk into accounts with valid passwords, and it can open doors for further intrusion.

What to do

Inferred

If you have a Yatra account, the sensible precaution given the reported credential leaks is to change that password now and switch on two-factor authentication, an extra code beyond the password. Do not reuse the old password anywhere else.

Inferred

For companies in Yatra's position, the reported employee credentials in the infostealer logs point to the standard playbook: reset exposed accounts, enforce 2FA, and look for signs those logins were misused.

Alleged

DailyDarkWeb itself advises treating the listing as an unverified threat-actor claim, not confirmation of a breach. Hold that line until the company or independent researchers produce evidence.

Confirmed and still uncertain

Observed

What is established: Yatra appears on the LockBit 5.0 leak site, the post describing the listing is public, and it carries an image of the listing itself.

Observed

What is missing: no data volume has been verified, no samples have been released for checking, and Yatra has issued no public confirmation of an incident.

Inferred

The open questions that would reshape the story: whether any intrusion into Yatra actually happened, and whether the separate infostealer logs have any link to the leak-site listing.

What people are saying

Alleged

DailyDarkWeb, the account that surfaced the listing, is unusually blunt about its limits: treat this as an unverified threat-actor claim, not confirmation of a breach, because no data has been checked and the company has said nothing.

Observed

Yatra has said nothing publicly so far. LockBit 5.0's side of the conversation is only the listing itself, which makes claims without offering verifiable proof.

Evolution

Observed

LockBit 5.0 is described in the post as the rebuilt version of the ransomware operation, and it has been relisting victims on its leak site at a steady pace since coming back.

Inferred

The Yatra listing extends that pattern rather than breaking it, which suggests the group has settled into a regular rhythm of naming targets as its rebuilt operation matures.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Inferred

A data-leak site is the extortion stage of a ransomware operation: when a victim does not pay, the crew threatens to publish stolen material on a public page to add pressure. An appearance there is a threat and a sales tactic, not forensic evidence of theft.

Inferred

Infostealers are malware that quietly pull saved passwords, cookies and other login material from infected devices. The analyst note flags such stolen credentials as a common entry path for ransomware, which is why the separate logs drew attention alongside the listing.

Sources and evidence

Observed

This item rests on a single source: a post by DailyDarkWeb on X reporting the leak-site listing, with a screenshot credited to the account. The same post is also the origin of every caveat repeated here, from the unverified data to Yatra's silence.

Inferred

Stronger evidence would mean independently verified samples from the listing, a public statement from Yatra, or corroboration from a second monitoring service. None of that exists in the current batch, so confidence in anything beyond the listing itself should stay low.