Leak-site post naming Kirbor Homes, captured by ThreatCluster
Back to victims

Kirbor Homes

pear

Ransomware leak-site victim intelligence · EN

Data size
1.8 Tb
Posted
Jun 18, 2026
Country
USA
Industry
Construction Management

Summary

Written by ThreatCluster from victim profile, leak post, our reporting

PLAY claims to have exfiltrated 1.8 TB of data from Kirbor Homes, a USA-based construction-management firm described by the group as a reputable Mid-Atlantic home builder. The attack reportedly occurred on June 10, 2026, and PLAY states they obtained sensitive personal data, including Social Security numbers. Kirbor Homes has not disclosed the total number of affected individuals. The leak post is published.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Revenue
$5.6M
Domains
kirbor.com

What was taken

Kirbor Homes is a reputable home builder located in the Mid-Atlantic region

Data categories
Financial dataHR dataContractsEmailsDatabasesPayments & Mortgage Details
Leak site tags
Pure Extraction And Ransom

Leak-site images (5)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Scan of a U.S. Employment Authorization document featuring personal details, including a photo, name, date of birth, and validity dates.
onion leak page 272 KB
Form 1065, U.S. Return of Partnership Income, with sections for partnership information, income, deductions, and signatures.
onion leak page 267 KB
Document titled "Certificate of Liability Insurance" with sections detailing coverage, policy numbers, and contact information for the insurance provider.
onion leak page 327 KB
Document titled "First Right of Refusal Contingency Addendum" with sections for buyer's contingencies, signatures, and dates related to a real estate transaction.
onion leak page 420 KB