A cybercriminal group called ShadowByt3$ claims to have stolen 14,476 client records from the John Engel Team, a real estate brokerage, including contact details, behavioral tracking data, and partial corporate payment card information. The notification became public in September 2026. Affected individuals should monitor credit reports and watch for phishing attempts referencing their real estate activity.
| Company | John Engel Team |
|---|---|
| Industry | Real Estate |
| Data Types Exposed | Names and Email Addresses, Behavioral and Property Interest Data, Email Engagement Metrics, Corporate Invoice Records, Partial Payment Card Information, Business Leader Contact and License Details |
| People Affected | 14,476 individuals |
| Attack Method | Extortion/Data Theft |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the John Engel Team Data Breach?
A cybercriminal group known as ShadowByt3$ has claimed responsibility for a data breach affecting the John Engel Team, a real estate brokerage operation. The group says it stole a large volume of client and business records. As a result, the incident now falls under close scrutiny as more details surface.
According to the threat actor’s own claims, the attackers extracted complete client databases along with detailed behavioral tracking information. They also say they took financial records, including a corporate payment card, and internal branding materials. The notification to the public came in September 2026, though the exact date the breach itself was discovered has not been publicly disclosed.
The attackers reportedly threatened to sell the stolen data on underground forums if the company did not negotiate within 72 hours. In addition, they claimed they would notify media outlets and breach-tracking services to increase pressure. This extortion approach did not appear to involve file encryption, meaning the primary threat centered on data exposure rather than system disruption.
Because this incident stems from a public extortion claim, independent forensic confirmation from the company itself has not been detailed in available reporting. However, the specificity of the data described, including exact record counts and internal file formats, suggests the attackers did gain some level of access. Investigators and the company would typically need to verify the scope through their own forensic review.
Who was affected?
Individuals affected likely include current and former clients of the John Engel Team, a real estate brokerage. This includes people who toured homes, submitted inquiries, or expressed interest in listings through the company’s digital systems. Because real estate transactions often involve significant personal and financial details, the population affected could include buyers, sellers, and prospective clients alike.
The threat actor claims 14,476 individuals had records included in the stolen data. This figure has not been independently verified by the company as of publication. In addition to clients, the leaked data reportedly includes information tied to the team’s leadership and administrative operations, meaning employees or business partners could also be affected.
Because real estate clients often span a wide range of ages and financial backgrounds, the exposure could touch a broad cross-section of consumers. There is no indication in available information that minors were specifically targeted. Still, anyone who interacted with this brokerage’s website, alerts, or communications during the relevant period should consider themselves potentially affected.
What Information Was Potentially Exposed?
The data described by the attackers spans several categories, ranging from basic contact details to detailed behavioral profiles and financial records. This combination makes the exposure particularly concerning. Below is a summary of the data types referenced in the extortion claim.
- Full names and email addresses of clients
- Behavioral tracking data, including homes viewed and homes marked as favorites
- Engagement metrics such as email opens, clicks, and alert views
- Predictive scoring data indicating purchase readiness
- Corporate invoice and billing records
- Partial corporate payment card information, including card number ending digits and expiration date
- Business leader’s name, email addresses, phone number, and real estate license number
- Internal branding and onboarding template files
This mix of data creates multiple avenues for misuse. For example, detailed behavioral profiles could allow scammers to craft highly convincing phishing messages. Because the data shows exactly which properties a person viewed or favorited, a fraudster could reference those details to appear legitimate.
Furthermore, exposed corporate payment information raises the risk of financial fraud, even if only partial card details were included. Contact information paired with personal interest data also increases the risk of targeted scams. As a result, both individual clients and the business itself face elevated fraud exposure following this incident.
What is the company doing?
Details about the John Engel Team’s specific response have not been widely disclosed as of this writing. Typically, organizations facing this type of extortion attempt engage cybersecurity specialists to investigate the scope of access. They also work to determine whether the stolen data matches what the attackers claim to possess.
Because the threat actors set a 72-hour negotiation deadline, the company likely faced pressure to respond quickly while also assessing legal obligations. In cases like this, organizations often notify affected individuals once the investigation confirms which records were compromised. Additionally, companies frequently review their security systems following an incident like this to prevent further unauthorized access.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should request a copy of their credit report from each of the three major credit bureaus. Reviewing these reports regularly can help you spot unfamiliar accounts or inquiries early. This is especially important given that financial account details were reportedly involved in this breach.
You can access free credit reports through AnnualCreditReport.com. Because early detection often limits damage, checking your report every few months for the next year is a reasonable precaution. If you notice anything unusual, report it to the credit bureau immediately.
Consider a Fraud Alert or Credit Freeze
Given that financial information may have been exposed, placing a fraud alert on your credit file is a smart step. This makes it harder for someone to open new credit accounts using your information. A fraud alert is free and typically lasts one year.
For stronger protection, you might also consider a credit freeze, which restricts access to your credit file entirely. Although this requires a bit more effort to lift when you need credit yourself, it offers significant protection against identity theft. Both options can be requested directly through each credit bureau’s website.
Watch for Phishing and Targeted Scams
Because the stolen data reportedly includes detailed behavioral profiles, scammers could use this information to craft convincing messages. For instance, a scam email might reference a specific property you viewed to seem legitimate. Therefore, treat unexpected emails or calls referencing real estate activity with caution.
Never click links or provide personal information in response to unsolicited messages. Instead, verify any communication by contacting the John Engel Team directly through a known phone number or website. This simple habit can prevent many phishing attempts from succeeding.
Protect Your Personal and Financial Identity
If your payment or billing information was involved, contact your card issuer to discuss your options. They may recommend issuing a new card number as a precaution. This step can prevent unauthorized charges before they happen.
Additionally, keep records of any suspicious activity and report it promptly. Consulting with a data breach attorney can help you understand your rights and whether you may qualify for compensation. Many attorneys offer free consultations to evaluate cases like this one.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.