ITC Properties Group Limited Data Breach

The Orova ransomware group has claimed ITC Properties Group Limited as a victim, posting the alleged compromise on their leak site on August 30, 2026. SOCRadar’s CTI analysis indicates that stealer-log telemetry had previously flagged a compromised third-party credential linked to the Hong Kong-based real estate firm’s infrastructure several months prior to the alleged intrusion. The Orova group claims to have gained unauthorized access to ITC Properties Group Limited’s systems and data, with the domain itcproperties[.]com being specifically mentioned. It is important to note that no independent verification of this breach claim has been completed at this time. In the preceding 60 days before this listing, Orova has claimed a total of 43 victims. Their primary targeting has predominantly focused on the United States and Hong Kong, with a strong emphasis on the Healthcare and Professional Services sectors. The inclusion of ITC Properties Group Limited, a Hong Kong-based real estate entity, aligns with the group’s established regional targeting patterns and extends their reach within the Asia-Pacific region. While Orova may not be the largest ransomware operation, its consistent activity and focus on this region present a significant risk to organizations operating within it.

SOCRadar CTI’s analysis of stealer-log data identified a “notable_exposure_in_sample” verdict for ITC Properties Group Limited. The telemetry indicated the compromise of one corporate third-party credential through the domain pen-shop[.]com[.]hk, suggesting a workstation compromise. This exposure was timestamped on February 22, 2026, which is approximately six months prior to the date Orova claimed ITC Properties Group Limited as a victim. This early foothold is a common tactic employed by ransomware operators to establish access before launching their attacks; a single compromised third-party credential can serve as an entry point for lateral movement within a network. The identified credential exposure through pen-shop[.]com[.]hk, dating back several months before the alleged listing, provides a potential pathway for the initial intrusion. This type of credential compromise, often facilitated by infostealers, can grant attackers access to corporate networks, including but not limited to Microsoft 365 accounts, VPNs, or other remote access portals. While this specific exposure does not definitively confirm the exact intrusion vector used by Orova, it strongly suggests a plausible scenario for gaining initial access. Continued monitoring of dark web sources and stealer-log feeds for any further mentions or evidence related to ITC Properties Group Limited is recommended. Proactive credential hygiene measures, including regular password rotation and the implementation or review of multi-factor authentication across all critical systems, should be prioritized. Additionally, organizations should monitor activity logs for Microsoft 365, VPNs, and remote-access solutions for any suspicious or unauthorized access attempts.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.