- A hacker named “2019” claims they obtained 17,300+ customer records from MMJ Real Estate and is offering it free of charge on a dark web forum.
- The leak data includes very sensitive information, names, emails, phone numbers, home addresses. It also contains property enquiry details like price ranges and investment plans.
- The free release could enable targeted phishing scams impersonating real estate agents.
A threat actor is offering thousands of customer records allegedly stolen from MMI Real Estate for sale on a dark web forum.
The alleged dataset includes names, addresses, and property enquiry details, and they’re giving it all away for free. It’s worth noting that this claim remains unverified as MMJ Real Estate has yet to make a public statement acknowledging any breach.
Details of the Actor’s Claims
On June 1, a user who goes by the name ‘2019’ posted on a cybercrime forum. They claimed to have a database from MMJ Real Estate. That is an Australian real estate company that deals in property sales, leasing, and manages properties.
The hacker said they’re offering the data free of charge. But there’s a catch – anyone interested must reply to the forum post first. Then you get the download link. It is a common trick on underground sites. It pushes the post higher. More people see it. More people engage with it.
Here is the thing. MMJ Real Estate has not said anything publicly yet. So there’s no telling if this post is legit or not.
What’s in the Alleged Leak
The hacker claims that the database has the personal info of over 17,300 people who have been in contact with MMJ Real Estate, maybe through a contact form or via email or a phone enquiry.
Allegedly the data includes names and last names. Email addresses. Mobile phone numbers. Residential addresses. Suburb info. That is a lot of personal identifiable information, or PII for short.
But it gets more detailed. The dataset also includes customer enquiry data. Think of form titles, enquiry types, business interest information, preferred price ranges, property requirements, and submission timestamps.
If this data is accurate, it provides an in-depth overview of your agency’s contacts. Besides knowing who contacted you, also view what items or services were requested for purchase, how much was offered to pay for those items or services, and whether it was an investment opportunity or merely casual inquiries.
The level of detail of this information may potentially provide insight into an individual’s financial status or intentions regarding real estate purchases.
No Passwords, But Still Dangerous
Unlike many breaches you hear about, this one does not involve passwords or payment info. The alleged MMJ leak centers on customer lead and enquiry data. That might sound less scary at first.
But cybersecurity experts warn otherwise. Detailed customer records are gold for criminals, it can aid phishing attacks, social engineering, even financial fraud.
Let’s say a scammer got a hold of your name, your address or maybe your phone number as well. And they somehow found out you’re looking to buy property worth $2 million. That scammer can now call you pretending to be your real estate agent. They know exactly what you were looking for. They sound legitimate. And you might just fall for it.
The structure of the exposed information suggests it came from website contact forms, customer relationship management (CRM) systems, or lead-generation platforms. Many real estate firms collect this kind of detailed info to follow up with potential buyers and investors.
Who is Behind this Leak?
The threat actor goes by “2019.” That name does not link to any major ransomware gang or well-known cybercriminal group. This has led some observers to guess that “2019” might be a data trader or just a forum participant. They could be reposting information someone else stole first.
Interestingly, they’re offering the whole dataset for free. Cybercriminals usually sell stolen information to make money. So why doesn’t this one come with a price tag? Hackers often use free releases to build their reputation. It draws attention to their profile. It can also promote other shady services they offer on the side.
What Happens Next?
If the dataset turns out to be real, MMJ Real Estate could face regulatory trouble. Australia has strict data protection rules. Organizations must assess whether a breach could cause serious harm. If yes, they have to notify regulators and affected customers.
This incident also shines a light on the real estate sector’s cybersecurity. These companies handle lots of sensitive personal and financial information daily. Which makes them prime targets for scammers.
Currently, everything remains uncertain. No one has independently confirmed that the records belong to MMJ. We do not know how old the data is and no evidence showing how the hacker got it. Until MMJ addresses the issue publicly, this is nothing but a claim. But it still reminds us: personal data is valuable. And criminals are always watching.
