Ransomware Group ShadowByt3$ Hits: John Engel Team

url: http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion/invoice.png

Data Compromised:

the leak contains 0.014 million contacts (exactly 14,476 unique customer records).
The following was stolen

1. Complete Identity and Client Databases (14,476 Total Profiles)

The extraction completely drains the brokerage team’s customer network, divided into three distinct lifecycle tables:

– 10,993 Nurtured Contacts:
– 3,306 Archived Contacts:
– 177 Awaiting Nurture Contacts: The fresh pipeline of new inquiries, open-house visitors, and active 30-day leads.

2. Deep Behavioral Tracking & Psychological Analytics

For every single one of those 14,476 profiles, We stole exact behavioral history and intent metrics, including:

– Predictive Intent Metrics: scout score and score change counters that signal exactly when a high-net-worth client is getting ready to purchase.
– Direct Interaction Metrics: Explicit lists of Homes Viewed, Homes Interested (properties starred or liked), Home Value Alert Views, and Market Activity Alert Views.
– Communication Analytics: Logs of Email receives, Email opens, email clicks, email rejects, and system Errors mapping out exactly how responsive a customer is to digital alerts.

3. Corporate Financial and Transaction Data

– 40 Invoice PDFs: A localized batch of billing records detailing contractual pricing, vendor relationships, and enterprise account balances.
– Corporate Payment Method: Active account billing profiles, explicitly exposing a corporate Visa card ending in 8265 with an expiration date of 01/29.

4. Direct Brand Impersonation Assets

– Administrative Access Details: The team leader’s personal profile details, including name, primary corporate emails ([email protected], [email protected]), direct contact phone numbers (203 247 4700), and official state real estate license number (RES.0787476).

– High-Definition Media Links: Pristine branding paths hosted on the platform’s live AWS CloudFront CDN network (d1buiexcd5gara.cloudfront.net

– Operational Templates: The exact welcoming and onboarding text strings used by the agents to register new users.

The .csv is in the format below:

Nurtured_Contacts
Name,Email,scout score,score change,type,tags,created at,Auto Nurture Active,Alerts,Email receives,Email opens,email rejects,email clicks,Homes Viewed,Homes Interested,Home Value Alert Views,Market Activity Alert Views,Errors,Starred

and that is for all of them. If you don’t negotiate we will sell it on underground forums for one person only and we will send proofs to bleepingcomputer and haveibeenpwned. You have 72 hours to negotiate it will get leaked on 09/12/2026 at 10:10 PM New York Time EST/EDT.

To negotiate are session is below for negotiations only

session: 05dd14d0860cb5d6901de01af2a84c026d914197d0f8ed892085ea3be556563301

contact us via email has a second option:
[email protected]