Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

#22 of 28 industriesWatch Real Estate

Real Estate: Who Is Hitting It.

As of Oct 19, 2026, 124 Real Estate organisations have been listed as ransomware victims on leak sites, 0.4% of all confirmed victims (about 1 in 250). The most active group in this sector is Akira.

Updated continuously · figures as of Oct 19, 2026
Confirmed victims
124
Share of all victims
0.4%
Rank
#22 of 28 sectors
Most active group
Akira
Most hit country
United States

Victims Posted Per Month.

Confirmed ransomware victims in Real Estate per month
MonthConfirmed victims
November 20250
December 20250
January 20260
February 20260
March 20260
April 20260
May 20260
June 20260
July 20260
August 20260
September 20260
October 2026 (month in progress)0

Most Active Groups Here

  1. Akira108.1% of all victims
  2. LockBit 3.0108.1% of all victims
  3. Play97.3% of all victims
  4. ALPHV97.3% of all victims
  5. RansomHub75.6% of all victims

Most Hit Countries In This Industry

  1. USUnited States6350.8%
  2. AUAustralia129.7%
  3. CACanada118.9%
  4. GBUnited Kingdom86.5%
  5. INIndia43.2%

Latest Victims.

All 124 Real Estate victims →
Latest confirmed ransomware leak-site victims in Real Estate
VictimClaimed byCountryIndustryData claimedPosted
Naftali Group
naftaligroup.com
SinobiUSUnited StatesReal Estate, Consulting118 GB
Rothmann Immobilien
engelvoelkers.de
DragonForceDEGermanyReal Estate, ConsultingNot stated
Washington Prime Group Inc
wpgus.com
World LeaksUSUnited StatesReal Estate, ConsultingNot stated
DHM Properties
dawnhomes.com
PlayUSUnited StatesReal Estate, ConsultingNot stated
AX CAPITAL
axcapital.ae
Kill SecurityAEUnited Arab EmiratesReal Estate, ConsultingNot stated
Thomas Safran & Associates
tsahousing.com
PlayUSUnited StatesReal Estate, ConsultingNot stated
IAD GmbH
iad.de
SarcomaDEGermanyReal Estate, ConsultingNot stated
shimaogroup.com
shimaogroup.com
DevManCNChinaReal Estate, Consulting3 TB

Sector Briefings For Real Estate, Every Week.

The Brandefense platform sends a weekly ransomware brief for your sector and region: new groups, new victims among your peers and suppliers.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.