Curtis Investment Group, Inc. Listed by Genesis Ransomware Group

On December 1, 2025, Curtis Investment Group, Inc., a full-service real estate company, appeared on the leak site of the genesis Ransomware Group in a listing claiming internal files were exfiltrated during a ransomware attack.

What Public Reporting Shows

Public reporting indicates the company’s data was posted to the genesis leak site, accessible via the onion address http://genesis6ixpb5mcy4kudybtw5op2wqlrkocfogbnenz3c647ibqixiad.onion/034516db93aa72827fb5/. Available reporting describes the incident as a ransomware attack in which attackers gained access, exfiltrated internal files, and later listed the victim when demands were not met. The exact number of people whose information may have been exposed remains unknown, and the specific types of documents have not been publicly detailed beyond the broad category of internal files. No confirmed timeline of initial access or exact volume of data has been released by the company or independent investigators.

Why This Matters for You and Your Family

When a real estate firm suffers a breach, the information at risk often includes names, addresses, phone numbers, email accounts, financial records, and details related to property transactions. If you or your family have ever worked with a real estate company, refinanced a home, rented property, or appeared in closing documents, your personal data may have been stored in systems like these. Real estate records frequently link directly to your current home address, making them valuable for identity thieves, stalkers, or scammers who want to target you or your children. A single leak can quietly sit on dark web forums for months or years before it is used, which means the exposure from this incident may affect you long after the news fades.

The Doxxing and Identity-Chain Risk

Stolen real estate files rarely stay isolated. Attackers combine them with other breached data to build detailed profiles that connect your email addresses, phone numbers, usernames, and family relationships. This process, known as identity chaining, turns one leak into a roadmap that can expose social media accounts, children’s gaming profiles, and even school-related information. Once attackers map these connections, they can move from simple identity theft to full doxxing—publishing your home address, phone number, and family details online. Credential leaks like this one regularly cascade into account takeovers on gaming platforms, where children’s usernames and reused passwords become entry points for harassment or further extortion.

Genesis Ransomware Group’s Known Activity

Public reporting attributes the attack to the genesis Ransomware Group. The group emerged in recent years and has targeted organizations across multiple sectors by deploying ransomware to encrypt systems, exfiltrating data before encryption, and then publishing samples on their leak site when victims refuse to pay. Their typical playbook involves initial access through common vulnerabilities or phishing, followed by data theft and extortion demands backed by the threat of public release. Notable prior victims have included companies in healthcare, manufacturing, and professional services, according to trackers that monitor ransomware activity.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles so you can see exactly what chains back to this real estate breach.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces it is caught and addressed in hours rather than months.
• Rotate any password you used with Curtis Investment Group or similar real estate services and enable 2FA through an authenticator app on every account where that password was reused.
• Cover your entire household with DoxxScan family protection that includes dependents and your children’s gaming accounts, which often become targets when home addresses and parent emails are exposed.
• Let remediation specialists handle the time-consuming work of sending takedown requests to data brokers and sites selling your information.

The incident shows that even mid-sized real estate companies remain prime targets, and the data they hold travels quickly through criminal networks. Taking concrete steps now can limit how far this claimed breach reaches into your life. DoxxScan by GalaxyWarden delivers continuous monitoring across more than 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping that connects usernames to real-world identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage also protects children’s gaming accounts that frequently become the next link in doxxing chains after credential leaks like this one.