Ransomware victim disclosure
← All victimsBerkadia Commercial Mortgage, LLC. (berkadia.com)
Claimed by Hunters International · listed 2 months ago
Status timeline
- Listed
Mar 24, 2026
- Data leaked
At a glance
- Status
- Data leaked
- Country
- United States
- Sector
- Financial Services
- Listed on leak site
- Mar 24, 2026
- Data size
- 27 GB
About the victim
AI dossier — public-source company profileBerkadia Commercial Mortgage, LLC is a leading U.S. commercial real estate services and finance company headquartered in Ambler, Pennsylvania. It operates across investment sales, mortgage banking, and loan servicing, ranking as the #1 Freddie Mac lender and #2 Fannie Mae DUS lender. Berkadia serves a broad range of property sectors including multifamily, affordable housing, seniors housing, hotels, and student housing nationwide.
- Industry
- Commercial Real Estate Finance & Mortgage Services
- Employees
- 1001-5000
- Founded
- 2009
Attack summary
Severity: critical — Confirmed exfiltration and publication of PII at scale (Salesforce records) from a major commercial mortgage and real estate finance firm; 27 GB of data has been published, involving regulated financial and personal data across a large client and employee base.Hunters International claims to have exfiltrated 27 GB (compressed) of data from Berkadia, including Salesforce records containing PII and internal corporate data, after the company declined to reach a ransom agreement. The data has been published as of 25 March 2026.
Data the group says was taken
AI dossier — extracted from the leak post- Salesforce CRM records
- Personally identifiable information (PII)
- Internal corporate data
The group's post references roughly 1 proof file.
What the group claims
Salesforce records containing PII and other internal corporate data have been compromised. The company failed to reach an agreement with us despite all the chances and offers we made. They don't care. | Size: 27GB (compressed) | Updated: 25 Mar 2026 | SHA256: 2ae1c2804c01f5894143620518ec41fceb98e330f408c7f38e3d6ef93ebe8f21
Sources
- Victim siteberkadia.com
Source
Indexed 2 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
