Sold Real Estate, Sold RE PTY LTD Listed by radar Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a real-estate firm appears on a ransomware group's leak site, the practical concern for clients, staff and partners is straightforward: internal files may have left the organisation's control. Sold RE PTY LTD was listed by the group known as radar on 17 October 2025. The number of people affected remains unknown, and the precise contents of the material have not been publicly confirmed beyond the claim that internal files were taken. For anyone who has dealt with the company, that uncertainty itself creates a need for clear information and basic protective steps.

Public reporting indicates that Sold Real Estate and UrbanX PTY LTD share an Active Directory network infrastructure, and the listing references a partial file list associated with urbanx.io. Until independent verification or official statements appear, the scale and exact impact stay limited to what the group has asserted.

What happened

On 17 October 2025, Sold RE PTY LTD was named on the leak site operated by the radar ransomware group. The available summary states that internal files were exfiltrated during a ransomware attack. It also notes that Sold Real Estate and UrbanX PTY LTD share an Active Directory network infrastructure, and it points to a partial listing of files under a path that includes a reference to urbanx.io. No confirmed figure for the number of people affected has been released, and details of the initial intrusion method, the full volume of data, or any ransom demand remain undisclosed in public sources. The listing itself constitutes the group's claim that material was taken and may be published if its conditions are not met.

The group behind it: radar

Radar is a ransomware operation that follows the now-familiar double-extortion model: encrypt systems and simultaneously copy data, then threaten to release the stolen material on a dedicated leak site if payment is not received. Like other groups in this category, it typically posts victim names, sample file lists and, in some cases, larger archives once a deadline passes. Public reporting on radar has documented its use of common initial-access techniques and its focus on organisations whose data carries commercial or personal value. In this instance the group claims to hold internal files from the Sold RE / UrbanX environment; that claim has not been independently verified beyond the leak-site entry and the partial file-list reference already noted. No further statements attributed specifically to this victim have been made public.

Who is Sold RE PTY LTD?

Sold RE PTY LTD operates in the Australian real-estate sector, handling property sales, listings and related client services. Firms of this type routinely maintain records of property owners, buyers, tenants, financial arrangements, identity documents and correspondence. The shared Active Directory infrastructure with UrbanX PTY LTD means that network credentials and access controls may have been common to both entities, potentially expanding the surface that an attacker could reach once inside. A breach involving such an organisation is consequential because real-estate data often combines personal identifiers with financial and location information that remains useful to criminals long after the initial incident.

The information in question

The facts state only that internal files were exfiltrated in a ransomware attack. No exhaustive inventory of data types has been published. Organisations in the real-estate sector typically hold client names, contact details, addresses, identification documents, transaction records, contracts and internal operational files. The partial file list referenced on the leak site is associated with urbanx.io, but its exact contents have not been independently confirmed. Because the precise nature of the material remains unconfirmed, it is not possible to state with certainty which categories of personal or commercial information were included.

What's at stake

For individuals whose details may appear in the files, the concrete risks include targeted phishing, identity misuse and unsolicited contact that leverages knowledge of property transactions or personal circumstances. Even limited internal documents can supply enough context for convincing social-engineering attempts. For the organisation, the consequences include potential regulatory scrutiny under Australian privacy rules, disruption of operations, and the longer-term cost of restoring trust with clients and partners. Because the number of affected people is unknown and the full data set has not been verified, the actual exposure level cannot yet be quantified; the prudent assumption is that anyone who has supplied personal or financial information to Sold RE or related entities should treat the possibility of compromise seriously.

Were you affected?

If you have been a client, employee or supplier of Sold RE PTY LTD or UrbanX PTY LTD, begin by monitoring bank and credit accounts for unexpected activity and treat any unexpected emails or calls that reference property dealings with caution. Change passwords used with the company if they were reused elsewhere, and enable multi-factor authentication wherever available. Official notifications, if any are issued, will provide the most reliable guidance on next steps. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a check does not confirm involvement in this specific incident but can indicate whether the address is circulating more widely.

AICompiled with AI assistance from public sources and published under our editorial standards.