Sotheby’s International Realty Listed by coinbasecartel Ransomware Group

On December 9, 2025, the CoinbaseCartel ransomware group added Sotheby’s International Realty to its leak site and began publishing what it claims are internal files stolen during a ransomware attack on the luxury real-estate firm.

What's Publicly Reported from Reporting

Public reporting indicates the group exfiltrated internal documents and is using the leak site to pressure the company. The exact number of records exposed remains unknown, and Sotheby’s International Realty has not yet issued a public statement detailing the breach. Available reporting describes the incident as a classic ransomware operation: initial access, data theft, encryption of systems, and subsequent extortion through public exposure. The primary evidence sits on the dark-web leak page hosted at the onion address linked through ransomware.live.

Why This Matters for You and Your Family

When a major real-estate brokerage loses control of internal files, the ripple effects reach ordinary home buyers, sellers, and renters whose personal information often sits in those systems. Names, addresses, phone numbers, email addresses, financial details tied to property transactions, and sometimes Social Security numbers are typical contents of real-estate databases. If your family has bought, sold, or rented through Sotheby’s International Realty or any affiliated broker in recent years, your data may now be in the hands of criminals. Once stolen, that information does not expire; it can be sold, traded, or used years later to open fraudulent accounts, file fake tax returns, or impersonate you in loan applications.

The Doxxing and Identity-Chain Risks

A single breach rarely stops at one company. Cybercriminals routinely combine newly leaked real-estate records with data from earlier breaches to build detailed profiles. An address from a property closing can be linked to an email address from a past breach, a username from a gaming site, and a phone number from a retail breach. This identity-chain mapping lets attackers locate you across the internet, target your children’s online gaming accounts, or launch convincing spear-phishing campaigns against every member of the household. Public reporting on similar incidents shows that credential leaks of this nature frequently cascade into account takeovers on email, banking, and social-media platforms.

CoinbaseCartel’s Publicly Known Track Record

Public reporting attributes the group’s emergence to mid-2024. The cartel has targeted a range of organizations, with a focus on companies that handle high-value transactions or store sensitive customer records. Its typical playbook involves gaining initial access through phishing or exploited remote-desktop services, exfiltrating data before deploying ransomware, then demanding payment while threatening to publish the stolen files on its leak site. The group maintains a public-facing extortion page where it posts samples and countdown timers, a tactic designed to maximize pressure on victims who fear reputational damage or regulatory fines.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup of exposed records.
• Rotate any password you ever used at Sotheby’s International Realty or affiliated brokers, and enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing accounts.

The speed with which criminals connect one breach to the next means ordinary families must treat every exposed real-estate record as a long-term threat. Starting with a clear picture of your current exposure and maintaining ongoing vigilance is the most practical defense. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that links online handles to real identities, and hands-on remediation by specialists who manage takedowns for you and your entire household, including children’s gaming accounts that frequently become targets once a family address surfaces.