BOZZUTO Data Breach

Vortex listed BOZZUTO — a US real estate company — on its dark web victim site on 2026-11-10. The listing was observed by the SOCRadar Dark Web Team as part of its ongoing dark web monitoring and open-source intelligence gathering. Real estate is an atypical sector for Vortex, which has concentrated its recent campaign on healthcare and manufacturing, making this listing notable as a signal of expanding scope. Real estate organizations with substantial remote access exposure, including property management portals, may represent attractive targets for groups seeking to monetize access to corporate environments. Vortex has claimed approximately 14 victims over the preceding 60 days, with a focus on US healthcare, manufacturing, and professional services, alongside European targets. Recent victims include Scripps (US, Healthcare), Arthrex (US, Healthcare), Andersen Construction (US, Manufacturing), and Solenis (US, Manufacturing). BOZZUTO’s listing suggests the group is widening its US target set beyond its core sector focus, and the company therefore does not match Vortex’s established targeting pattern. This divergence from the group’s typical healthcare and manufacturing concentration may indicate that the group is actively broadening its acquisition of access opportunities across additional US industries.

SOCRadar’s credential correlation found no infostealer matches for BOZZUTO in SOCRadar’s monitored datasets at the time of this report. This is a null result and should not be treated as a clearance. The absence of records in the queried datasets does not confirm that the organization is unaffected: credentials may exist under alternate corporate domains, may be tied to personal email aliases, may be present in feeds outside the datasets queried, may have been used and rotated before indexing, or may not yet have been indexed. The absence of evidence is not evidence that no compromise occurred. The null result is particularly relevant given Vortex’s access methodology. Vortex relies on credential logs from infostealers such as Lumma, RedLine, and Stealc, which are traded across dark web markets and Telegram. Infostealer-harvested credentials can support ransomware operations by giving attackers or initial access brokers validated corporate account access, which may be leveraged against Microsoft 365, VPNs, or remote-access portals as a potential intrusion path. This is a possible attack scenario based on the group’s known methodology, and no evidence confirms that this specific access method was used against BOZZUTO. Defenders should continue dark web and stealer-log monitoring for BOZZUTO-related credentials, including alternate corporate domains. Proactive credential-hygiene checks and password rotation are recommended, along with a review of multi-factor authentication, with phishing-resistant MFA on remote access and property management portals. An internal credential audit and privileged access review are also advised. Real estate organizations with substantial remote access exposure should treat Vortex’s expanded targeting as a direct alert.