Propertyfinder and PropSpace CRM targeted in alleged coinbasecartel data leak

• Ransomware group: coinbasecartel
• Country: United Arab Emirates
• Sector: Retail & E-Commerce
• Announcement date: March 30, 2026

The coinbasecartel ransomware group has announced a significant data breach involving Propertyfinder and PropSpace CRM. According to a post on the group's leak site, the threat actors claim to have successfully compromised the systems of both platforms, resulting in the theft of a massive volume of sensitive information.

The alleged attack and auction announcement

The coinbasecartel group asserts that they have obtained approximately 1 TB of data from the targeted organizations. Rather than a traditional ransom demand for decryption, the threat actors have opted for an auction-based monetization strategy. The group has publicly stated that they are offering the stolen data for sale through an auction process, inviting bidders to participate in the acquisition of the information.

To support their claims of a successful breach, the group has published various screenshots as proof of the intrusion. These visual aids are accompanied by statements from the attackers that specifically highlight alleged security vulnerabilities within the organization's technical infrastructure. This method of using screenshots is a common tactic used by ransomware groups to demonstrate the legitimacy of their claims to potential buyers or to pressure the victim organization.

Scope of the alleged data theft

The data claimed to be stolen is extensive and covers multiple critical components of the organizations' digital operations. The leak allegedly includes highly sensitive information that could be used for various malicious purposes. According to the group's announcement, the compromised datasets include:

• Customer database records
• Property listings
• CRM data

In addition to these structured databases, the threat actors claim that the leak contains various files that contain specific customer information. The breadth of this data suggests a deep level of access into the operational databases used by both the real estate platform and its associated CRM software.

Organization profiles

The targets of this alleged attack are prominent entities within the real estate technology sector. Propertyfinder is a leading digital platform operating in the MENA region, providing real estate listings and property search services. PropSpace is a CRM software developed by the company specifically for real estate professionals.

Risks and industry implications

This alleged leak may create significant secondary risks for the organization's customers and partners. The exposure of customer databases and CRM data often leads to identity theft and highly targeted phishing attacks, where attackers use specific details to gain trust during social engineering attempts. For organizations operating in the United Arab Emirates, such a breach may lead to legal and administrative sanctions under applicable data protection regulations.

The use of an auction method by coinbasecartel may indicate that the group intends to monetize the data as quickly as possible. Publicly available information regarding this specific group remains limited. Furthermore, the compromise of a CRM system can significantly increase supply chain risks, as the breach of a service provider can lead to widespread data exposure across its entire network of professional users and clients.

In the broader context of cyber threats, this event highlights the ongoing risks of double extortion, where attackers not only encrypt data but also threaten to leak it to maximize pressure. To defend against such threats, organizations typically focus on implementing robust access controls, maintaining rigorous patch management to close vulnerabilities, and employing continuous monitoring to detect unauthorized access to sensitive databases and CRM environments.