Century Management Services listed on Storm ransomware leak site

• Ransomware group: Storm
• Country: United States
• Sector: Professional Services
• Announcement date: September 30, 2026

Storm ransomware group claims data breach at Century Management Services

The threat actor group known as Storm has officially listed Century Management Services on its dedicated leak site. The group claims to have successfully exfiltrated a significant amount of data belonging to the New York-based organization, marking a potential high-impact security incident for the professional services firm.

This type of announcement is a common tactic used in double extortion ransomware campaigns. In these scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak the stolen data on a public forum, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information.

Details of the claimed attack and deadline

According to the announcement made on September 30, 2026, the Storm group asserts that they have gained unauthorized access to the systems of Century Management Services. The group's listing serves as a public notification of the alleged breach, a move designed to maximize psychological pressure on the target organization.

The attackers have established a specific timeline regarding the potential release of the stolen information. A deadline of October 9, 2026, has been set for the potential release of this data. Such countdowns are frequently used by ransomware groups to create a sense of urgency and panic during negotiations.

Scope of the alleged data theft

While the specific types of data involved in this incident have not been explicitly detailed by the threat group, the scale of the alleged theft is substantial. The group claims to possess a dataset consisting of the following:

• 198 GB of total data
• 69,181 files
• 8,685 folders

The lack of specific information regarding the content of these files—such as whether they contain personal identifiers, financial records, or proprietary business documents—makes it difficult to immediately assess the exact nature of the sensitive information at risk.

About Century Management Services

Century Management Services is a full-service property management company headquartered in New York. Established in 1971, the organization has a long-standing presence in the professional services sector. They specialize in managing a diverse portfolio of residential properties, which includes the management of rentals, co-ops, and condos. In addition to property oversight, the company provides essential financial and project management services to its clients.

Potential impact and organizational risks

This incident suggests that sensitive corporate and personal data within Century Management Services may be at risk of exposure. Because the organization is based in the United States, a potential data breach could trigger complex legal processes under relevant state laws and federal regulations. The legal and regulatory implications for companies in the professional services sector can be significant following such allegations.

Beyond the immediate legal concerns, the employees and clients of the organization may face secondary risks. These risks include the possibility of identity theft or the targeting of individuals through sophisticated phishing attacks using the stolen information. Such attacks often exploit the trust established between a service provider and its clients.

The assessment of this threat is complicated by the fact that information regarding the Storm group remains limited, making it difficult to fully understand their specific tactics, techniques, and procedures. Ultimately, the allegation of a breach could adversely affect the organization's operational processes and the level of trust maintained with its clients. Organizations in this sector typically focus on robust data protection, employee training, and comprehensive incident response plans to mitigate the impact of such potential threats.