NAI Earle Furman Listed by Secp0 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

A ransomware group known as Secp0 has listed NAI Earle Furman on its leak site, according to a report dated September 22, 2026. That listing is an accusation from an extortion crew, not a confirmation from the company, a regulator, or an independent breach index. As of writing, NAI Earle Furman has not publicly confirmed the claim.

For clients, tenants, employees, and counterparties who deal with a commercial real-estate brokerage and property-management firm, the practical stake is straightforward: if internal file-server material were ever taken and published, it could include deal, accounting, commission, and staff-related records. Public detail on whether anything was actually removed, how many people might be involved, or what exact files are at issue remains limited. The sensible response is to treat the claim as unverified and to take measured steps if your relationship with the firm means your information could plausibly appear in such material.

What is being claimed

Secp0 has listed NAI Earle Furman on its leak site. The reported summary associated with that listing describes what the group presents as a reviewed dataset: a single-snapshot, single-volume file-server tree path labeled E:/Shares, said to contain about 1.36 million paths. According to that same summary, the tree is claimed to cover brokerage deals, a property-management portfolio tied to MRI accounting, broker commissions, employee home directories, and data from the absorbed Croxton Gray firm.

The number of people affected is unknown. Named data types beyond the listing’s own description are not disclosed in the available record. Timing of any intrusion, method of access, ransom demand, and whether any files were actually released are undisclosed in the facts provided. Nothing in the public record supplied here establishes that the company’s systems were compromised; the leak-site entry is the group’s claim.

Who is Secp0?

Secp0 is known publicly as a ransomware and extortion actor that follows a pattern common to many leak-site crews: encrypt or exfiltrate data, then pressure victims by threatening to publish material on a dedicated site if payment is not made. Groups of this type often post victim names, countdown-style pressure, and sample descriptions of stolen file trees to increase leverage. Their listings are marketing and coercion tools, not audited inventories.

Well-documented public reporting on such actors emphasizes that claims can be exaggerated, partially recycled from older incidents, or false. For this specific listing, only what appears in the reported summary should be attributed to Secp0: the group claims a large file-server snapshot related to NAI Earle Furman and related portfolio and commission material. No independent confirmation of those claims is included in the facts at hand.

About NAI Earle Furman

NAI Earle Furman operates in commercial real estate brokerage and related property services. Firms in this sector typically handle deal files, lease and sale documentation, commission tracking, and property-management accounting. Many also maintain employee records and, after mergers or absorptions, legacy data from prior firms—here, the listing refers to Croxton Gray material as part of what Secp0 claims to hold.

A leak-site listing aimed at such an organisation matters because the business sits at the intersection of owners, tenants, investors, brokers, and staff. Even an unproven claim can create uncertainty for people who shared identity, financial, or contractual information in the course of ordinary transactions. That uncertainty is about risk management for individuals, not a verdict on the firm’s security.

The information in question

The facts do not confirm that any specific category of personal data was taken. Data types are recorded as not disclosed beyond the attacker’s own description. Secp0’s listing summary claims a file-server tree covering brokerage deals, MRI-related property-management accounting, broker commissions, employee home directories, and absorbed Croxton Gray firm data. That description is the group’s claim, not a verified inventory.

If files of the kind commercial brokerages and property managers commonly hold were involved, organisations in this sector typically retain items such as contact details, transaction and lease records, commission worksheets, accounting exports, and internal staff folders. Whether any of that exists in the material Secp0 advertises—and whether it includes sensitive personal identifiers—is unconfirmed. Readers should not assume their records are in any dump solely because of the listing.

Why it matters

For individuals, the conditional risk is misuse of contact, financial, or deal-related information if such material were ever published: targeted phishing that references real properties or commissions, social-engineering attempts against tenants or investors, or exposure of employee personal files stored on shared drives. For the organisation, a public extortion listing can disrupt client trust and create legal and notification questions even when the underlying claim is unproven.

A leak-site post does not by itself establish that systems were breached, that the described volume is authentic, or that the path count is accurate. It establishes only that a named group chose to associate the company’s name with a claimed dataset. Treating the accusation as settled fact would overstate what is known; ignoring it entirely would understate why people who work with the firm may want basic precautions.

Steps worth taking either way

Because the incident is unconfirmed and the company has not publicly verified it, actions should stay proportional and conditional—useful if your data ever appears, harmless if it does not.

• If you are a client, tenant, or counterparty, watch for unexpected messages that cite specific deals, properties, or commission details and verify any payment or document requests through known channels.
• If you are or were an employee, review whether personal files were stored in shared home directories and consider credit and account monitoring if you later learn sensitive identifiers were involved.
• Prefer unique passwords and multi-factor authentication on email and financial accounts so a single exposed credential is less useful.
• Treat unsolicited “breach support” or recovery offers with skepticism; extortion ecosystems often spawn follow-on scams.
• You can run a free exposure scan of your email to check whether your address has already appeared in other known breach datasets, which is a separate check from this unverified listing.

Public detail remains limited. Until NAI Earle Furman or a competent authority confirms or denies the claim, the responsible stance is to note what Secp0 asserts, avoid treating the listing as proven theft, and take ordinary hygiene steps that reduce harm if any related material ever surfaces.

AICompiled with AI assistance from public sources and published under our editorial standards.