ADDA (adda.io) Listed by ransomexx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 7 March 2025 the ransomware group ransomexx listed ADDA (adda.io) on its leak site, claiming responsibility for a ransomware attack in which internal files were taken. Public reporting of the listing states that records relating to 12 million residents, visitors and staff may have been involved. For people who live in, visit or work at communities managed through the service, the practical stakes are immediate: personal details held by a residential-management platform can be used for targeted fraud, identity misuse or unwanted contact if they surface outside the organisation’s control.

The number of people actually affected remains unknown, and independent confirmation of the full scope is not yet public. What is known is limited to the group’s claim and the reported summary of the incident.

Inside the incident

According to the available record, ADDA was listed by the ransomexx ransomware group on 7 March 2025. The listing asserts that internal files were exfiltrated during a ransomware attack. The reported summary characterises ADDA as a SaaS platform for residential community management and states that 12 million records of residents, visitors and staff were leaked. No further technical details—such as the precise date the intrusion began, the initial access method, the encryption status of systems, or any ransom demand—have been disclosed in the public facts. The number of individuals whose data was actually compromised is listed as unknown. All specifics beyond the group’s claim and the short reported summary remain unconfirmed.

The group behind it: ransomexx

Ransomexx is a well-documented ransomware operation that has been active for several years. Like many contemporary ransomware groups, it typically follows a double-extortion model: data is stolen before systems are encrypted, and the threat of public release is used to pressure victims. The group maintains a leak site on which it posts the names of organisations it claims to have compromised, often accompanied by sample files or statements about the volume of data taken. Ransomexx has previously targeted a range of sectors, including technology, manufacturing and services, and is known for operating as a ransomware-as-a-service or closely affiliated affiliate model. In this case the group claims to have listed ADDA after exfiltrating internal files; that claim has not been independently verified in the public record, and no additional statements from the group about this specific victim beyond the listing itself are included in the available facts.

ADDA (adda.io) and its sector

ADDA operates a software-as-a-service platform used for residential community management. Such platforms typically support apartment complexes, gated communities and similar residential developments by handling resident directories, visitor logs, access control, maintenance requests, staff records and related administrative data. Because the service sits at the centre of day-to-day community operations, it routinely processes personal identifiers, contact details, occupancy information and sometimes payment or access credentials for large numbers of people. A breach affecting a platform of this type is consequential precisely because the data it holds is both personal and operational: it can reveal who lives where, who visits, and who works on site. The reported summary notes that the platform serves records associated with 12 million residents, visitors and staff, underscoring the potential scale of any exposure even while the exact number of affected individuals remains unknown.

What was likely exposed

The facts state that internal files were exfiltrated in the ransomware attack. The reported summary further indicates that 12 million records of residents, visitors and staff were leaked. Beyond that description, the precise data types and fields contained in those files have not been disclosed. Organisations that provide residential community-management SaaS commonly hold names, addresses, contact numbers, email addresses, unit or property identifiers, visitor logs, staff employment details and related administrative records. Whether any or all of those categories were present in the files claimed by ransomexx cannot be confirmed from the public information. The exact contents therefore remain unconfirmed; only the group’s assertion of internal-file exfiltration and the reported figure of 12 million records are on record.

The real-world impact

For individuals whose information may have been taken, the concrete risks include phishing or social-engineering attempts that reference community details, identity-related fraud, and unwanted contact. Residential and visitor data can also be combined with other leaked sets to build more complete profiles. For ADDA itself the incident carries operational and reputational consequences: the need to investigate, notify affected parties where required, and restore confidence among property managers and residents who rely on the platform. Because the number of people affected is listed as unknown and the full contents of the files are unconfirmed, the precise scale of harm cannot yet be measured. The listing alone, however, places both the organisation and the people connected to the communities it serves under heightened scrutiny and potential secondary risk.

Were you affected?

If you live in, visit or work at a residential community that uses ADDA’s management platform, treat the possibility of exposure seriously even while confirmation is pending. Monitor financial and email accounts for unusual activity, be cautious of unsolicited messages that reference your community or personal details, and consider placing fraud alerts with credit agencies if you believe sensitive identifiers may be involved. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Public detail on this incident remains limited; further verified information, if it emerges, will clarify the true scope.

AICompiled with AI assistance from public sources and published under our editorial standards.