Sotheby’s International Realty Listed by Coinbase Cartel Ransomware Group

On December 9, 2025, the CoinbaseCartel ransomware group added Sotheby’s International Realty to its leak site and began publishing what it claims are internal files stolen during a ransomware attack on the luxury real-estate firm.

What Public Reporting Shows

Public reporting indicates the group exfiltrated internal documents and is using the leak site to pressure the company. The exact number of records exposed remains unknown, and Sotheby’s International Realty has not yet issued a public statement detailing the breach. Available reporting describes the incident as a classic ransomware operation: initial access, data theft, encryption of systems, and subsequent extortion through public exposure. The primary evidence sits on the dark-web leak page hosted at the onion address linked through ransomware.live.

Why This Matters for You and Your Family

When a major real-estate brokerage loses control of internal files, the ripple effects reach ordinary home buyers, sellers, and renters whose personal information often sits in those systems. Names, addresses, phone numbers, email addresses, financial details tied to property transactions, and sometimes Social Security numbers are typical contents of real-estate databases. If your family has bought, sold, or rented through Sotheby’s International Realty or any affiliated broker in recent years, your data may now be in the hands of criminals. Once stolen, that information does not expire; it can be sold, traded, or used years later to open fraudulent accounts, file fake tax returns, or impersonate you in loan applications.

The Doxxing and Identity-Chain Risks

A single breach rarely stops at one company. Cybercriminals routinely combine newly leaked real-estate records with data from earlier breaches to build detailed profiles. An address from a property closing can be linked to an email address from a past breach, a username from a gaming site, and a phone number from a retail breach. This identity-chain mapping lets attackers locate you across the internet, target your children’s online gaming accounts, or launch convincing spear-phishing campaigns against every member of the household. Public reporting on similar incidents shows that credential leaks of this nature frequently cascade into account takeovers on email, banking, and social-media platforms.