Universal Realty Group data allegedly listed on 8base leak site

• Ransomware group: 8base
• Country: Canada
• Sector: Professional Services
• Announcement date: September 8, 2023

Ransomware group 8base claims data breach at Universal Realty Group

The ransomware group known as 8base has listed data allegedly belonging to the Canadian real estate development and management firm Universal Realty Group on its leak site. This announcement, which appeared on the group's platform, suggests that the organization has been targeted in a cyberattack aimed at exfiltrating sensitive corporate information.

Details of the alleged attack

The 8base group announced the addition of Universal Realty Group to its list of victims on September 15, 2023. According to the threat actor, they successfully gained access to the organization's internal systems. The group claims that this unauthorized access allowed them to exfiltrate various corporate documents from the company's network.

The post made by the attackers includes general information regarding the company's business operations and provides a list of the specific categories of data that are purportedly leaked. While the group is known for utilizing double-extortion tactics—a method where attackers both encrypt data and threaten to leak it to pressure victims into paying—the specific details of the ransom demand or the exact volume of data stolen have not been disclosed in the available information.

Compromised data categories

The post specifies that several types of sensitive documentation are among the information that has been compromised. The categories of data mentioned by the threat actor include:

• Invoices
• Receipts
• Accounting records
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements
• Client files

About Universal Realty Group

Universal Realty Group is a real estate development and management company based in Halifax, Canada. Their extensive portfolio includes over 2,300 apartments and a significant amount of commercial space. In addition to managing these properties, the company provides a variety of professional services, including property management, asset management, and marketing services.

Potential impact and industry implications

This alleged breach may pose secondary risks such as identity theft and targeted phishing attacks for the organization's employees and customers. Because the compromised data includes personal information, employment contracts, and client files, the impact could extend beyond the company's immediate digital infrastructure to affect the individuals represented in those documents.

As the organization operates in Canada, the incident may trigger data privacy obligations under PIPEDA regulations. Organizations operating in the professional services and real estate sectors must remain vigilant, as the scope of leaked data in such cases could create negative impacts on corporate reputation. Given the organization's commercial and residential management portfolio, the sensitivity of the data involved is significant.

The 8base group is recognized as a double-extortion actor that has been active since 2022. They are known to utilize encryptors derived from Phobos. Although their infrastructure was disrupted in early 2025, the continuity of similar methods may be observed in the threat landscape. For organizations in similar sectors, maintaining robust security postures and following data privacy regulations is essential to mitigate the risks of such targeted exfiltration campaigns.