Skip to content
Leak-site post naming Zara Investment Holding, captured by ThreatCluster

Zara Investment Holding

payload

Ransomware leak-site victim intelligence · EN

Data size
83 GB
Posted
Aug 13, 2026
Country
Jordan
Industry
tourism and hospitality

Summary

Written by ThreatClusterfrom victim profile, leak post

The group payload claims to have exfiltrated 64 GB of data from Zara Investment Holding (zaraholding.com). The leak description states the data includes HR and recruitment records, internal documentation and source code. The publication status is countdown, with the victim identified as Zara Investment Holding.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
zaraholding.com

What was taken

Zara Investment Holding (zaraholding.com) is a leading Jordanian investment group established in 1994. The company specializes in the tourism and hospitality sector, serving as the largest owner of five-star hotels and luxury resorts in key destinations across the country, including Amman, Petra, and the Dead Sea. Playing a vital role in Jordan's economy, the holding provides approximately 30% of the nation's total five-star hotel capacity.

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

leak
http://payload6eualw6kni6v2lqn7ovjcl76ojx25z5unsyvqo3lbqy3bo5qd.onion/
site
https://zaraholding.com

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture