Property Finder and PropSpace listed by Coinbasecartel on leak site

• Ransomware group: Coinbasecartel
• Country: United Arab Emirates
• Sector: Professional Services
• Announcement date: November 4, 2025

Coinbasecartel claims massive data breach at Property Finder and PropSpace

The threat actor known as Coinbasecartel has listed the real estate platforms Property Finder and PropSpace on their leak site. According to the group's announcement, they claim to have compromised a significant amount of data, alleging that the total volume of stolen information reaches 1 TB.

This announcement, made on November 4, 2025, follows the group's claim of having successfully infiltrated the organizations' systems. While the group has provided samples of the alleged data as proof of their access, the full extent of the breach remains subject to the group's claims.

Details of the alleged attack and data theft

The Coinbasecartel group alleges that they gained access to the organizations' systems by exploiting security vulnerabilities. By bypassing security measures, the threat actor claims to have extracted a vast repository of information. The group has shared screenshots as evidence to support their claims of holding a total of 1 TB of data.

The information the group claims to have stolen is diverse, spanning various aspects of the business operations for both Property Finder and PropSpace. The alleged data set includes:

• Customer data
• CRM records
• Real estate listings

The inclusion of CRM (Customer Relationship Management) records is particularly significant, as these systems typically house sensitive business data and direct contact information for clients. The group claims that the stolen data also includes various reports and specific property listings.

About Property Finder and PropSpace

Property Finder is a leading real estate portal operating in the Middle East and North Africa region. It provides a digital platform that helps users manage the buying, selling, and renting of properties. Through its services, it serves as a central hub for real estate transactions in these markets.

Potential risks and implications of the breach

This alleged breach may pose several secondary risks to the individuals and entities involved. For the customers of Property Finder and PropSpace, the exposure of personal information could lead to identity theft and targeted phishing attacks. When attackers possess contact details and transaction histories, they can craft highly convincing fraudulent communications to deceive victims.

Furthermore, the claim of access to CRM systems suggests that sensitive business data and customer contact information could be exposed. For the organizations, such a leak can lead to significant reputational damage and cause disruptions in their operational processes. Under the data protection regulations in the United Arab Emirates, the organization may face mandatory data breach notification requirements.

Regarding the threat actor, information about the Coinbasecartel group is limited. However, their methods suggest they may employ a double-extortion strategy. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release unless a ransom is paid. This increases the pressure on the victim to comply with demands to avoid the reputational and legal fallout of a public data leak.

In response to such threats, organizations in the professional services and real estate sectors often focus on strengthening their security posture. This typically involves implementing robust access controls, enhancing monitoring of sensitive databases like CRM systems, and conducting regular vulnerability assessments to identify and patch flaws before they can be exploited by threat actors.