harcourts.net Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 17, 2026, the ransomware group safepay listed harcourts.net on its site, claiming to have obtained internal files from the organisation. The number of individuals affected is not known, and no further details about the scale or timing of the incident have been made public. The practical stakes centre on the possibility that personal or financial information held by a long-established real estate firm could now circulate beyond its intended recipients. Real estate companies routinely process documents that identify clients, property owners and transaction parties, so any confirmed exposure would require those individuals to monitor their accounts and correspondence for signs of misuse.

Breaking down the breach

The only confirmed public information is the listing itself and the statement that internal files were allegedly exfiltrated during a ransomware attack. No figure for the volume of data, the number of records, or the date of the intrusion has been released. It is not known whether the organisation has confirmed the listing or whether any ransom demand was paid.

The group behind it: safepay

Safepay is a ransomware operation that publishes victim names on a dedicated site when negotiations fail or to increase pressure. The group follows the common pattern of encrypting systems and threatening to release stolen material. Its listings are claims made by the actors themselves; independent verification of the data or the circumstances of each incident is not provided by the group.

harcourts.net and its sector

Harcourts.net traces its origins to a real estate agency founded in Wellington, New Zealand, in 1888. The firm has expanded into a network that operates across multiple countries. Real estate organisations of this type maintain records that include client identification, property details, transaction histories and communications with buyers, sellers and related service providers.

The information in question

The listing refers only to internal files obtained in a ransomware operation. The precise categories of data contained in those files have not been disclosed. Organisations in this sector commonly hold names, addresses, contact details, financial information related to property transactions and identification documents, but the exact contents of the exfiltrated material remain unconfirmed.

Why it matters

Exposure of internal files from a real estate firm can create opportunities for targeted fraud or identity misuse, particularly where transaction or identification records are involved. For the organisation, the incident adds to the operational and reputational costs already associated with ransomware events, including potential regulatory scrutiny over the handling of client information.

What to do if you're exposed

Individuals who have conducted business with harcourts.net or similar agencies should review bank and credit statements for unusual activity and consider placing fraud alerts with credit reporting agencies. Changing passwords for any accounts linked to the organisation and enabling multi-factor authentication where available are immediate steps that limit further access. Readers can run a free exposure scan of their email address to check whether their information has surfaced in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.