Otthon Centrum Listed by qilin Ransomware Group

On May 27, 2026, real estate company Otthon Centrum appeared on the leak site of the qilin ransomware group. The attackers published what they describe as internal files exfiltrated during a ransomware incident. While the exact number of people affected remains unknown, anyone whose personal information was stored in the company’s systems could now be exposed.

What's Publicly Reported from Reporting

Public reporting indicates that qilin listed Otthon Centrum and began publishing stolen data on its leak site. The exposed material consists of internal files taken after the ransomware deployment. No confirmed total of records or specific customer count has been released by the company or the attackers. The listing appeared on May 27, 2026, and follows the group’s standard pattern of posting samples to pressure victims.

Why This Matters for You and Your Family

When a company that handles home purchases, mortgages, or rental agreements is breached, the files often contain names, addresses, phone numbers, email addresses, dates of birth, government identification numbers, and financial details. If your family bought, sold, or rented property through Otthon Centrum, some of that information may now be in criminal hands. Once stolen data surfaces on a ransomware leak site, it spreads quickly to other criminals who combine it with information from earlier breaches.

Credential leaks like this one frequently cascade into account takeovers on email, banking, and social media. Children’s accounts are not immune; gaming usernames linked to a parent’s email or phone number can become entry points for harassment or further identity theft.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at posting one set of files. They create doxxing chains by linking exposed emails, phone numbers, and addresses to usernames on social platforms, gaming services, and data-broker records. A single address from a real-estate transaction can tie your family’s home location to children’s Roblox, Fortnite, or Discord accounts. Public reporting shows these chains accelerate identity theft, targeted phishing, and physical threats. What begins as a corporate breach can become a persistent personal exposure that lasts for years.

Qilin’s Publicly Known Track Record

Public reporting attributes the qilin ransomware group’s emergence to 2022. The group has targeted organizations across healthcare, education, manufacturing, and professional services. Notable prior victims include hospitals and municipal governments whose patient and citizen data appeared on the same leak site. Qilin’s typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files before encryption. The group then demands payment and, if unmet, publishes samples or full datasets on its onion site while offering the data for sale to other criminals.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by specialists.
• Rotate any password you used at Otthon Centrum anywhere else it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that chain back to the same address or email.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing accounts.

The incident shows that corporate data breaches continue to create long-term risks for ordinary families who never chose to do business with a ransomware target. Acting quickly on exposed credentials and hidden data linkages can limit the damage. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting protective measures now reduces the chance that this claimed breach becomes the first link in a larger chain of identity theft or doxxing.