On July 1, 2025, the municipal advisor Capmark.org appeared on the leak site of the qilin ransomware group, with internal files reportedly exfiltrated during a ransomware attack. Anyone whose personal or financial information passed through Capmark’s systems—including clients, borrowers, or public-jurisdiction employees—may now have records exposed.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch capmark.org
Get alerted the next time capmark.org files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about capmark.org’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates that Capmark, an independent registered municipal advisor focused on bond issuance, planning, and cash-flow financing for public entities, suffered a ransomware intrusion. The attackers extracted internal files before encrypting systems. Available details list the victim count as unknown, but the data exposed includes sensitive internal documents that often contain names, addresses, financial identifiers, and correspondence tied to public projects. The listing carried a typical ransomware deadline for negotiation or further publication.
Why This Matters for You and Your Family
When a financial-advisory firm like Capmark is hit, the ripple effects reach ordinary people. If you or your family have ever lived in a jurisdiction that issued bonds, applied for public financing, or worked with municipal projects, your personal details may have been inside the stolen files. Names, addresses, Social Security numbers, bank routing data, and loan documents are common in such records. Once leaked, this information fuels identity theft, fraudulent loan applications, and targeted scams that can drain accounts or damage credit for years.
Children’s records are not immune. Many municipal programs collect family data for school bonds, housing assistance, or recreational facilities. A single exposure can link a parent’s identity to a child’s details, creating long-term privacy and safety risks.