Ithbar Listed by killsec Ransomware Group

On November 25, 2024, crowdfunding platform Ithbar appeared on the leak site operated by the ransomware group Killsec. The listing states that internal files were exfiltrated during a ransomware attack on the company, which provides software for real estate and equity crowdfunding platforms. The number of people whose data is contained in the files remains unknown, and the leak-site posting does not specify exactly which documents or datasets were taken.

Details from the Leak-Site Listing

The primary disclosure on the Killsec leak site states that Ithbar.com suffered a ransomware incident resulting in the theft of internal files. No specific volume of records is published, nor does the listing detail the precise data types beyond the broad category of internal files. The posting follows the group’s standard format of naming the victim, describing the attack type, and presumably offering the stolen material for download or auction to other threat actors. As is typical with many ransomware leak sites, the exact contents are not summarized in the public index page, leaving affected individuals without immediate clarity on what personal information may have been exposed.

Why This Matters for You and Your Family

When a crowdfunding platform like Ithbar is breached, the internal files can easily contain donor records, investor details, payment information, email addresses, phone numbers, and physical addresses tied to both the platform’s users and its operational staff. If you have used Ithbar to invest in real estate or equity projects, or if you maintain an account there, your personal and financial data may now sit in an attacker-controlled archive. Even without exact record counts, the exposure creates immediate risks of identity theft, phishing campaigns tailored to crowdfunding participants, and potential financial fraud. Families who have invested together or listed dependents on accounts face compounded risk because one person’s leaked details can expose household relationships and shared financial histories.

The Doxxing and Identity-Chain Implications

Stolen internal files from a crowdfunding platform frequently include not just names and contact information but also account usernames, hashed passwords, API keys, and notes that link online handles to real-world identities. These fragments become building blocks for doxxing chains: an attacker who obtains your email from the Ithbar files can cross-reference it with credential leaks from other services, gaming platforms, or social media to map your entire digital footprint. Credential leaks like this one cascade into account takeovers, allowing threat actors to seize control of email, banking, or social accounts and then demand payment or publicly release further personal information. Children’s gaming accounts that reuse the same email address or password patterns are especially vulnerable because gaming platforms often hold payment methods and chat logs that can be weaponized for harassment or further extortion.

Killsec’s Publicly Known Track Record

Public reporting attributes Killsec with emerging in mid-2024 as a relatively new ransomware and extortion operation. The group has targeted organizations across multiple sectors, typically gaining initial access through phishing, remote desktop protocol exploitation, or compromised credentials before exfiltrating data and deploying ransomware. Their playbook follows a double-extortion model: they encrypt victim systems and simultaneously threaten to publish stolen files unless a ransom is paid. Notable prior victims listed on their site have included small-to-medium businesses and technology service providers. The group’s leak site is used both to pressure victims into payment and to sell access to the stolen data to other criminals, increasing the long-term circulation of any information allegedly taken from Ithbar.

What to do

• Rotate any password you used on Ithbar.com anywhere else it is reused, and immediately enable 2FA with an authenticator app rather than SMS.
• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity, taking advantage of cleanup of Warden.
• Enable continuous DoxxScan monitoring so the next breach exposing your data is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same breached credentials.
• Let remediation specialists handle takedown requests across data brokers and extortion sites for you while you focus on securing your accounts.

The Ithbar breach is another reminder that even niche service providers hold data that can fuel extended identity attacks long after the initial ransomware incident fades from view. Starting proactive defense now limits how far attackers can travel along the identity chain created by this and future leaks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts at risk from cascading credential leaks.