CRESA Data Breach

Vortex listed CRESA on its dark web victim site on 2026-11-10, adding the US commercial real estate advisory firm to the group’s ongoing extortion campaign. CRESA operates across corporate real estate transactions, lease negotiations, and tenant representation, an advisory profile that concentrates client-sensitive data across the transactions and negotiations the firm handles. Ransomware groups typically treat this type of material as high-value leverage in extortion, because its disclosure carries direct commercial and reputational consequences for both the firm and the clients it represents. The listing places CRESA within a Vortex campaign that has claimed approximately 14 victims in the past 60 days. Professional services firms have appeared among those listings alongside the group’s dominant healthcare and manufacturing targets. Vortex has primarily targeted US organizations, with the occasional European victim, so a US-based professional advisory firm fits the group’s established pattern well. CRESA’s combination of a US footprint and a client-facing advisory business model therefore matches both the sector mix and the geographic focus Vortex has demonstrated throughout this campaign.

SOCRadar’s stealer-log query for CRESA returned no matching credential records. That result is bounded by the datasets sampled and should not be read as confirmation that the firm’s credentials are clean. Credentials may exist in feeds outside the queried dataset, under alternate corporate domains, or behind personal email aliases, and recently harvested data may not yet have been indexed. The absence of records in this telemetry is not evidence that no compromise occurred. Vortex relies on infostealer-sourced credentials as its primary initial access path, drawing on logs produced by tools such as Lumma, RedLine, and Stealc, which are traded on dark web markets and Telegram. Professional services firms with client portal access and high-value document repositories are frequently targeted via exactly this route, and CRESA’s advisory profile places it in that category. Exposed credentials circulating from infostealer collections could provide the foothold Vortex needs to reach corporate systems, although no evidence in the available telemetry confirms that this access method was used against CRESA specifically. Credential hygiene reviews and privileged access audits are advised regardless of the stealer-log result. Phishing-resistant MFA on all remote access and client-facing systems, combined with ongoing credential monitoring, substantially reduces the risk posed by infostealer-harvested credentials. Continued dark web and stealer-log monitoring — the coverage provided by SOCRadar’s Attack Surface Management and Dark Web Monitoring modules — supports early detection of any future credential exposure tied to the firm.