Skip to content
Leak-site post naming Lakeshore Title Agency, captured by ThreatCluster

Lakeshore Title Agency

ransomexx

Ransomware leak-site victim intelligence

Data size
341GB
Files
457
Posted
Mar 4, 2025
Country
usa
Industry
Title agency / Real estate

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

Ransomware group ransomexx claims Lakeshore Title Agency’s data totaling 341GB across 457 files was stolen. Sample filenames published include upload.7z.001 through upload.7z.012. The leak page identifies the victim as Lakeshore Title Agency, a US title agency, with revenue noted as over $100 million in commercial transactions and over $700 million in residential refinances and purchases. The leak post is published.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

Lakeshore Title Agency has closed over $100 million in commercial transactions and over $700 million in residential refinances and purchases. Leak size: 341GB.

File types seen
001 × 1002 × 1003 × 1004 × 1005 × 1006 × 1007 × 1008 × 1009 × 1010 × 1011 × 1012 × 1013 × 1014 × 1015 × 1016 × 1017 × 1018 × 1019 × 1020 × 1021 × 1022 × 1023 × 1024 × 1025 × 1026 × 1027 × 1028 × 1029 × 1030 × 1031 × 1032 × 1033 × 1034 × 1035 × 1036 × 1037 × 1038 × 1039 × 1040 × 1041 × 1
Sample files (41)
upload.7z.001
upload.7z.002
upload.7z.003
upload.7z.004
upload.7z.005
upload.7z.006
upload.7z.007
upload.7z.008
upload.7z.009
upload.7z.010
upload.7z.011
upload.7z.012
upload.7z.013
upload.7z.014
upload.7z.015
upload.7z.016
upload.7z.017
upload.7z.018
upload.7z.019
upload.7z.020
upload.7z.021
upload.7z.022
upload.7z.023
upload.7z.024
upload.7z.025
upload.7z.026
upload.7z.027
upload.7z.028
upload.7z.029
upload.7z.030
upload.7z.031
upload.7z.032
upload.7z.033
upload.7z.034
upload.7z.035
upload.7z.036
upload.7z.037
upload.7z.038
upload.7z.039
upload.7z.040
upload.7z.041

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

FILELIST
http://rbx2hfyej6sogivjtw2z2xkcqwgtiy653ap5jylggsrj6glbmfr7axqd.onion/78b69bb3237878a7495406d59d7020b4/tree.7z

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture