Ithbar Listed by killsec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 25, 2024, the organization Ithbar was listed by the ransomware group killsec, which claims to have conducted a ransomware attack involving the exfiltration of internal files. Public detail on the incident remains limited: the number of people affected is unknown, and no further specifics on timing, scale, or method have been disclosed beyond the group's listing. Ithbar operates a crowdfunding platform focused on real estate and equity projects, making any exposure of internal material potentially relevant to users, partners, and the firm itself.

The listing itself constitutes a claim by the group rather than independently confirmed detail. What is known so far centers on the assertion that internal files were taken during a ransomware incident, with no public confirmation of the full scope or verification of the data's contents.

Inside the incident

According to available reports, Ithbar was listed by killsec on November 25, 2024, in connection with a ransomware attack in which the group claims internal files were exfiltrated. No additional public information has been released regarding how the intrusion occurred, when it began, how long it lasted, or the volume of material involved. The number of individuals potentially affected is unknown. Public detail is limited to the fact of the listing and the stated nature of the data as internal files taken in a ransomware operation. No independent confirmation of the claim has been reported, and no further technical indicators or timelines have been disclosed.

The group behind it: killsec

killsec is a ransomware group known for double-extortion tactics, in which operators encrypt systems while also stealing data and threatening to publish it on dedicated leak sites if demands are not met. The group typically lists victims publicly as part of its pressure campaign, often providing limited samples or descriptions of claimed material to demonstrate access. Prior activity associated with killsec has involved targeting organizations across various sectors, with listings that emphasize the presence of internal documents, databases, or operational files. In this case, the group claims Ithbar as a victim and asserts that internal files were exfiltrated; that listing remains an unverified claim unless separately confirmed. No statements attributed to killsec beyond the fact of the listing and the description of internal files appear in the available record for this specific incident.

Ithbar and its sector

Ithbar presents itself as a solution for building crowdfunding platforms, with a focus on real-estate and equity crowdfunding. Organizations of this type typically facilitate fundraising between project sponsors and investors, handling platform operations, user accounts, project documentation, and related administrative processes. Crowdfunding platforms in the real-estate and equity space commonly process sensitive commercial information, investor details, and internal operational records. A breach involving such an organization is consequential because it can affect confidence in the platform, expose business relationships, and create risks for participants who rely on the service for financial or project-related activities. Public background on the sector indicates that these platforms often hold data that, if compromised, could influence both individual users and the broader ecosystem of alternative finance.

The information in question

The available facts state that internal files were exfiltrated in a ransomware attack. Exact contents of those files have not been disclosed or independently verified. Organizations operating crowdfunding platforms for real estate and equity typically maintain internal records that may include project documentation, administrative correspondence, user-related operational data, financial process files, and system configurations. Because the precise nature of the material claimed by killsec remains unconfirmed, it is not possible to state what specific categories of information were involved. Public detail is limited to the description of internal files; no further breakdown has been provided.

The real-world impact

For individuals connected to Ithbar—whether as platform users, project sponsors, investors, or staff—the primary risks center on the potential misuse of any personal or financial details that may have been present in the internal files. Even without confirmed data types, exposure of operational records can lead to targeted phishing, identity-related fraud, or unwanted contact. For the organization itself, the incident raises concerns about operational continuity, reputational effects within the crowdfunding sector, and the need to assess and contain any unauthorized access. Because the number of people affected is unknown and the exact contents remain unconfirmed, the full extent of impact cannot be quantified from public information. Concrete steps for those who interact with the platform include monitoring accounts for unusual activity and remaining alert to communications that reference crowdfunding or real-estate investments.

Were you affected?

If you have used Ithbar's crowdfunding services or provided information to the platform, treat the situation as a potential exposure until more detail emerges. Practical first steps include reviewing account activity for unauthorized changes, enabling stronger authentication where available, and watching for phishing attempts that reference the platform or related investments. Change passwords associated with the service if you have not done so recently, and avoid clicking unsolicited links claiming to relate to the incident. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Public detail on this specific listing remains limited, so continued caution and monitoring are advisable.

AICompiled with AI assistance from public sources and published under our editorial standards.