RK Centers listed on sinobi ransomware leak site

• Ransomware group: sinobi
• Country: United States
• Sector: Professional Services
• Announcement date: December 18, 2025

RK Centers targeted by sinobi ransomware group

The real estate development company RK Centers has been listed on the leak site of the ransomware group known as sinobi. The threat actor announced the incident on December 18, 2025, claiming that the organization's systems have been encrypted during the attack.

Details of the claimed attack

According to the announcement made by the sinobi group, the attack occurred on December 18, 2025. In the listing, the threat actor has included a specific monetary figure of 7,600,000 USD, which is alleged to represent the annual income of RK Centers. This type of demand is a common tactic used by ransomware groups to pressure victims into paying a ransom to avoid further consequences.

Ransomware attacks typically involve a malicious actor gaining unauthorized access to a network to encrypt critical files, effectively locking the victim out of their own data. Once the encryption is complete, the attackers demand payment in exchange for a decryption key. The inclusion of financial figures related to a company's revenue suggests that the attackers are attempting to scale their demands based on the perceived financial capacity of the victim.

Information regarding the leaked data

The listing provided by the sinobi group includes various technical images related to system information and server management. However, the group has not provided any specific information regarding the scope or the specific types of data that may have been compromised during the incident.

• No specific data types or file categories were named in the listing.

In many modern ransomware campaigns, threat actors employ a method known as double extortion. In this scenario, attackers do not just encrypt the data to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. This allows them to threaten the victim with the public release of stolen data on a leak site if the ransom is not paid. This tactic significantly increases the pressure on organizations, as the threat shifts from mere operational disruption to potential reputational damage and legal liability.

About RK Centers

RK Centers is a family-owned real estate development company. The firm specializes in the acquisition, development, and operation of open-air shopping centers located in New England and South Florida. The company manages a significant portfolio, encompassing over 10 million square feet of retail and office space.

Impact assessment and industry implications

This incident reflects a ransomware attack claim that may affect the operational continuity of RK Centers. Given the company's activities within the real estate and retail sectors, there is a risk that any potentially leaked customer or employee data could be utilized by malicious actors for identity theft or targeted phishing attacks. Furthermore, as a United States-based entity, the organization may face legal processes triggered under relevant state laws and data protection regulations following such a breach.

The potential impact of such an attack often extends beyond the primary target. In complex business environments, the supply chain partners of an organization may also be indirectly affected by the disruption or the leakage of information. For companies operating in the real estate and retail sectors, maintaining robust cybersecurity posture is essential to protect sensitive stakeholder information and ensure business continuity.

To defend against such threats, organizations typically implement multi-layered security strategies. This includes maintaining regular, offline backups of critical data to ensure recovery in the event of encryption. Additionally, implementing strict access controls, conducting regular security audits, and providing employee training on phishing awareness are standard defensive steps used to mitigate the risk of unauthorized network access and data exfiltration.