TruAmerica Multifamily Data Breach

TruAmerica Multifamily, a prominent US real estate firm specializing in apartment communities, has been listed on the dark web portal of the Termite ransomware group. The listing occurred on September 22, 2026, and was identified by SOCRadar’s Dark Web Monitoring service. As a company focused on investment and property management, TruAmerica Multifamily handles substantial amounts of sensitive data, including personal information of tenants, investor details, and property management credentials. This profile makes it a potentially attractive target for ransomware and extortion operations. Termite has shown a pattern of activity over the past 60 days, claiming six other victims. Their operations have primarily targeted organizations in the United States and China, with a focus on the Manufacturing, Financial Services, and Healthcare industries. Recent US victims include theLender, Sealcon, Everglades Boats, and Affinia Healthcare. TruAmerica Multifamily’s business model, which involves managing significant asset and tenant data within the US, aligns with Termite’s known targeting preferences for American organizations that handle valuable financial and property records.

SOCRadar’s investigation involved querying stealer-log data for the domain truamerica[.]com. The query returned no records within the specific dataset slice that was examined. It is important to note that this query was bounded and paginated, and the absence of results does not rule out the possibility of compromised credentials. Such credentials might exist under alternate corporate domains, be associated with personal email aliases used for corporate services, or reside in marketplaces that have not yet been indexed in the queried dataset. The lack of direct stealer-log correlation does not exonerate TruAmerica Multifamily. The Termite ransomware group has a history of targeting US-based companies that possess high-value financial and asset data. A real estate investment firm of TruAmerica’s size and scope is likely to hold a significant volume of tenant Personally Identifiable Information (PII), investor data, and property management credentials. This type of data is valuable for both extortion purposes and for resale on underground marketplaces, potentially facilitating further criminal activities. Assessment: The null stealer-log result should not be interpreted as a confirmation that the organization is unaffected. Termite has consistently targeted U.S. firms that manage substantial financial and asset data. An entity like TruAmerica Multifamily, involved in real estate investment and property management, would possess sensitive data including tenant PII, investor information, and essential property management credentials. This data holds significant value in both extortion scenarios and for subsequent sale on the black market. Next Steps: Rotate credentials for all accounts associated with the truamerica[.]com domain, giving priority to remote access services, property management platforms, and Microsoft 365 accounts. Conduct a thorough review of VPN and RDP access logs for any anomalous sessions occurring in the 30 days preceding September 22, 2026. Continue to monitor Termite’s dark web portal for any potential publication of data related to TruAmerica Multifamily.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.