Sinobi ransomware group claims data breach against Naftali Group

• Ransomware group: Sinobi
• Country: United States
• Announcement date: September 29, 2025

The threat actor known as Sinobi has claimed to have compromised data belonging to Naftali Group. This claim was made through a listing published on the group's dedicated leak site, marking a significant escalation in the ongoing threat landscape facing the organization.

The details of the claim

According to the announcement made on September 29, 2025, the Sinobi group claims to have targeted Naftali Group. The group asserts that the attack took place on September 28, 2025. Following the alleged compromise, the threat actors issued a massive ransom demand of $90,200,000. The group has threatened to publish the institution's data if this demand is not met. While the threat actor has made these public claims, it is important to note that public information regarding the Sinobi group remains limited, and the veracity of these claims has not yet been verified by independent sources.

This type of activity is characteristic of modern ransomware operations, which often employ a tactic known as double extortion. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information. The threat of leaking this data on a public forum serves as additional leverage to compel the victim to pay the ransom, targeting the organization's desire to avoid public exposure and regulatory scrutiny.

Data involved in the incident

Regarding the specific nature of the files or information that the threat actor claims to have stolen, the listing provides no specific details. No information has been provided concerning the types of data involved, the total size of the compromised data, or the specific file count. The listing names no data types.

About Naftali Group

Naftali Group is a New York-based private real estate development and investment firm. The company specializes in the acquisition, development, and management of properties with high growth potential in strategic locations.

Risk assessment and industry implications

This claim may pose significant risks to Naftali Group's operational continuity and corporate reputation. As a United States-based entity, a potential data breach could trigger investigations under state-level data protection laws and various regulatory bodies. The high ransom demand may indicate that the threat actor is specifically targeting the company's financial capacity.

Given the company's position in the real estate sector, any leaked financial or commercial data could lead to secondary risks. These include the exposure of trade secrets or the facilitation of targeted phishing attacks against the company or its partners. In the real estate industry, where transactions involve high-value assets and sensitive financial details, the impact of a breach can extend far beyond the initial digital disruption.

To mitigate such risks, organizations in this sector typically focus on robust defensive measures. These include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized movement within the network, and ensuring regular, offline backups are maintained. Furthermore, because a breach can lead to regulatory investigations, maintaining a clear incident response plan and ensuring compliance with regional data protection standards are critical components of a modern cybersecurity posture. However, as of now, the scope of the breach and the accuracy of the Sinobi group's claims remain unverified.