Harcourts Hit by SafePay Ransomware Gang, Data Leak Threatened
Harcourts, a global real estate company founded in 1888 with operations across Australia, New Zealand, the U.S., Canada, and other regions, has been listed on the dark web leak site of the SafePay ransomware gang. The threat actors claim to have stolen data and are threatening to leak it within two days and 15 hours as of the latest update. The listing has already garnered 621 views, though no sample data or details about the breach have been released.
Harcourts has not yet responded to requests for comment. This is not the company’s first cybersecurity incident in 2022, a breach at its Melbourne franchise exposed tenant, landlord, and contractor data, prompting apologies from CEO Adrian Knowles and offers of credit monitoring and IDCARE support for affected individuals.
Real estate firms are prime targets for cyberattacks due to the sensitive financial and personal data they handle, including names, addresses, bank details, rental histories, and contact information. Such data can be exploited for fraud, phishing, and impersonation scams.
SafePay, first observed in October 2024, has claimed over 500 victims across Australia, the U.S., the U.K., and other countries. The group denies operating as a ransomware-as-a-service (RaaS) provider, distinguishing itself from other cybercriminal operations. The full extent of the Harcourts breach and its potential impact remain unclear.
Source: https://www.cyberdaily.au/security/13771-exclusive-harcourts-allegedly-hacked-by-safepay-ransomware
Harcourts TPRM report: https://www.rankiteo.com/company/harcourts
"id": "har1781821433",
"linkid": "harcourts",
"type": "Ransomware",
"date": "6/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Real Estate',
'location': ['Australia',
'New Zealand',
'U.S.',
'Canada'],
'name': 'Harcourts',
'type': 'Real estate company'}],
'data_breach': {'data_exfiltration': 'Yes',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Addresses',
'Bank details',
'Rental histories',
'Contact information']},
'description': 'Harcourts, a global real estate company, has been listed on '
'the dark web leak site of the SafePay ransomware gang. The '
'threat actors claim to have stolen data and are threatening '
'to leak it within two days and 15 hours. The listing has '
'garnered 621 views, though no sample data or details about '
'the breach have been released. Harcourts has not yet '
'responded to requests for comment.',
'impact': {'brand_reputation_impact': 'Potential reputational damage',
'data_compromised': 'Sensitive financial and personal data (names, '
'addresses, bank details, rental histories, '
'contact information)',
'identity_theft_risk': 'High',
'payment_information_risk': 'High'},
'investigation_status': 'Ongoing',
'motivation': 'Financial gain, data extortion',
'ransomware': {'data_exfiltration': 'Yes', 'ransomware_strain': 'SafePay'},
'references': [{'source': 'Dark web leak site (SafePay)'}],
'threat_actor': 'SafePay ransomware gang',
'title': 'Harcourts Hit by SafePay Ransomware Gang, Data Leak Threatened',
'type': 'Ransomware'}