Colliers Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who work with or for Colliers, or who have shared personal or business details with the firm, now face the practical question of whether their information sits among files claimed to have been taken in a ransomware attack. Public reporting so far gives no confirmed count of individuals affected and no itemised list of what left the network, so the immediate stakes remain uncertain but real: internal documents can contain contact details, contract terms, financial records and other material that outsiders can misuse for fraud, phishing or competitive harm.

On 19 February 2025 Colliers was listed by the ransomware group known as thegentlemen. The listing itself is a claim by that group that it exfiltrated internal files during a ransomware attack; independent confirmation of the full scope has not been published in the available record.

Breaking down the breach

What is known is limited to the public listing. Thegentlemen asserted that it had conducted a ransomware attack against Colliers and removed internal files. No technical details of the intrusion method, the date the attack began or ended, the volume of data taken, or any ransom demand have been disclosed in the facts available. The number of people whose information may be involved is recorded as unknown. The only data category named is “internal files exfiltrated in a ransomware attack.” Beyond that single description, the precise contents remain unconfirmed.

Colliers has not, in the material provided, issued a detailed public statement confirming or denying the claim, so the listing stands as an unverified assertion by the threat actor. Readers should treat every specific allegation about this incident as provisional until the organisation or independent investigators supply verified information.

The group behind it: thegentlemen

Thegentlemen is a ransomware operation that has appeared on public leak sites in recent years. Like many such groups, it typically gains access to corporate networks, encrypts systems, and claims to have copied data before encryption so that it can pressure victims by threatening to publish the material. Public reporting on the group describes a pattern of targeting mid-sized and larger organisations across multiple sectors, posting victim names on dedicated leak sites, and sometimes releasing sample files to demonstrate possession. These are well-documented general tactics; they do not prove any particular detail about the Colliers incident beyond the group’s own listing.

In this case thegentlemen has claimed responsibility for the Colliers listing and for the exfiltration of internal files. No further statements attributed to the group about this specific victim—such as file counts, ransom amounts or publication deadlines—appear in the facts supplied. Any additional claims that may surface later should be evaluated against independent verification rather than accepted at face value.

Colliers and its sector

Colliers International Group Inc. is a publicly traded commercial real-estate services firm (stock symbol CIGI) that reports annual revenue of approximately $5.2 billion. It provides sales and lease brokerage, landlord and tenant representation, capital-markets and investment services, property management, leasing and valuations to corporations, financial institutions, governments and individuals worldwide. The company operates across multiple asset classes and maintains a global footprint.

Organisations of this type routinely hold large volumes of sensitive commercial and personal data: lease agreements, client financials, employee records, property valuations, transaction documents and correspondence with institutional investors. A breach that reaches internal files therefore carries consequences not only for the firm’s own staff but for the many third parties whose information is stored in the course of ordinary business. Because real-estate transactions often involve high-value assets and long-term contractual relationships, the exposure of such material can affect competitive positions, client confidentiality and regulatory obligations.

What was likely exposed

The only category explicitly named is internal files taken during a ransomware attack. No further breakdown—such as whether the files included employee directories, client contracts, financial statements or system credentials—has been disclosed. In the absence of that detail it is not possible to state with certainty what left the network.

Commercial real-estate firms typically retain personal identifiers of employees and contractors, contact and financial information of clients and tenants, deal-related documents, and internal operational records. Any or all of those categories could be present among “internal files,” yet the exact contents remain unconfirmed. Readers should therefore avoid assuming that any particular data type was or was not involved until Colliers or a competent authority provides a verified inventory.

What's at stake

For individuals, the principal risks are identity-related fraud, targeted phishing that exploits knowledge of real business relationships, and the possible misuse of personal contact or financial details. For corporate clients and counterparties, leaked contracts or valuation data can undermine negotiating positions or reveal commercially sensitive strategies. For Colliers itself the stakes include operational disruption, potential regulatory scrutiny, reputational damage and the cost of investigation and remediation—none of which have been quantified in the public facts.

Because the number of people affected is unknown and the precise data types unconfirmed, the scale of harm cannot yet be measured. The prudent posture is to treat the possibility of exposure as real while waiting for clearer information, rather than to assume either catastrophic or negligible impact.

Were you affected?

If you have worked for Colliers, done business with the firm, or supplied personal or corporate information to it, begin by monitoring financial accounts and credit reports for unexpected activity. Be alert to phishing messages that reference real-estate transactions, property addresses or Colliers personnel; verify any such message through a separate, trusted channel before responding. Change passwords on accounts that may have been used in connection with Colliers business, and enable multi-factor authentication where available.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step will not confirm or rule out involvement in this specific incident, but it can surface other exposures that warrant attention. Continue to watch for official notices from Colliers; any verified notification will provide the most reliable guidance on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.