Propertyfinder / PropSpace CRM Listed by coinbasecartel Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target property and real-estate platforms, where large volumes of customer leads, listings and client records create high-value targets for extortion. In this environment, claims of multi-terabyte data theft appear regularly on leak sites, often before any independent confirmation of scope or impact.

On 10 November 2025, the ransomware group coinbasecartel listed Propertyfinder and its PropSpace CRM on its leak site, claiming to have exfiltrated more than 2 TB of internal files. The number of people affected remains unknown, and public detail on the incident is limited to the group’s own assertions.

Inside the incident

According to the listing published by coinbasecartel, the group claims to have obtained more than 2 TB of data from Propertyfinder and PropSpace CRM. The claimed contents include a full Propertyfinder leads database said to contain more than 10 million records, a full property listings database, and all PropSpace CRM client data. The listing characterises the material as internal files exfiltrated in a ransomware attack. No independent confirmation of the volume, the exact method of intrusion, or the timeline of the alleged compromise has been made public. The number of individuals whose information may be involved is undisclosed.

Inside coinbasecartel

coinbasecartel is a ransomware operation that maintains a public leak site on which it posts victim names and sample claims of stolen data. Like other groups of this type, it typically asserts that it has exfiltrated large volumes of files and threatens to release them unless a ransom is paid. Public reporting on the group has described a pattern of double-extortion tactics—encrypting systems while simultaneously advertising the data on its site. The listing of Propertyfinder and PropSpace CRM is presented by the group as evidence of a successful intrusion; it remains an unverified claim unless corroborated by the organisation or independent investigators.

About Propertyfinder

Propertyfinder operates as a major online real-estate platform serving markets in the Middle East and North Africa. Its PropSpace CRM is a customer-relationship-management system used by agents and agencies to manage leads, listings and client interactions. Organisations of this kind routinely hold extensive records of property seekers, sellers, agents and transaction-related data. A breach involving such systems is consequential because the information can include contact details, property preferences and commercial records that are useful both for fraud and for competitive intelligence.

The information in question

The only data types named in the public listing are those claimed by coinbasecartel: a full Propertyfinder leads database of more than 10 million records, a full property listings database, and all PropSpace CRM client data, together forming part of an asserted 2 TB collection of internal files. Exact contents beyond these claims remain unconfirmed. Real-estate platforms and their CRM systems typically store names, email addresses, phone numbers, property search histories, listing details and agent or client notes; whether any of these specific fields were present in the material the group claims to hold has not been independently verified.

What's at stake

If the claimed data are authentic and subsequently released or sold, individuals whose details appear in the leads or CRM databases could face targeted phishing, identity-related fraud or unwanted contact from third parties. Property listings and client records may also expose commercial relationships and transaction patterns that competitors or scammers could exploit. For the organisation itself, the incident raises the prospect of regulatory scrutiny, loss of client trust and the operational cost of investigation and remediation. Because the number of affected people is unknown and the full contents unconfirmed, the precise scale of these risks cannot yet be quantified.

Were you affected?

Anyone who has registered with Propertyfinder, submitted a property enquiry, or whose details were entered into PropSpace CRM by an agent should treat the claim seriously until more information emerges. Practical first steps include monitoring email and phone accounts for unusual activity, changing passwords on related services, and remaining alert to phishing messages that reference property searches or listings. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.