Harcourts Hit by SafePay Ransomware Gang, Data Leak Threatened Harcourts, a global real estate company founded in 1888 with operations across Australia, New Zealand, the U.S., Canada, and other regions, has been listed on the dark web leak site of the SafePay ransomware gang. The threat actors claim to have stolen data and are threatening to leak it within two days and 15 hours as of the latest update. The listing has already garnered 621 views, though no sample data or details about the breach have been released. Harcourts has not yet responded to requests for comment. This is not the company’s first cybersecurity incident in 2022, a breach at its Melbourne franchise exposed tenant, landlord, and contractor data, prompting apologies from CEO Adrian Knowles and offers of credit monitoring and IDCARE support for affected individuals. Real estate firms are prime targets for cyberattacks due to the sensitive financial and personal data they handle, including names, addresses, bank details, rental histories, and contact information. Such data can be exploited for fraud, phishing, and impersonation scams. SafePay, first observed in October 2024, has claimed over 500 victims across Australia, the U.S., the U.K., and other countries. The group denies operating as a ransomware-as-a-service (RaaS) provider, distinguishing itself from other cybercriminal operations. The full extent of the Harcourts breach and its potential impact remain unclear.

Check Point Patches Critical Zero-Day Exploited in VPN Attacks Linked to Qilin Ransomware Israeli cybersecurity firm Check Point has released urgent security updates to address a critical authentication bypass vulnerability (CVE-2026-50751) in its Remote Access VPN and Mobile Access deployments. The flaw, actively exploited in zero-day attacks since May 7, allows unauthenticated remote attackers to bypass authentication on vulnerable systems, including Mobile Access/SSL VPNs, Remote Access VPNs, and Spark firewalls. The vulnerability affects only deployments using the deprecated IKEv1 key exchange protocol, specifically those configured to accept legacy Remote Access clients without requiring machine certificate authentication. Exploitation surged in early June, impacting a few dozen organizations globally, with at least one confirmed case tied to the Qilin ransomware operation. Check Point’s investigation also uncovered a second flaw (CVE-2026-50752), which enables man-in-the-middle attacks on site-to-site VPN connections due to improper certificate validation in IKEv1. While no active exploitation of CVE-2026-50752 has been observed, the company urges immediate patching to prevent potential exposure. For organizations unable to patch immediately, Check Point recommends disabling IKEv1 support, enforcing IKEv2-only authentication, mandating machine certificate authentication, and enabling IPS with updated signatures. Qilin, a Ransomware-as-a-Service (RaaS) group active since August 2022, has claimed nearly 400 victims via its dark web leak site, targeting high-profile entities such as Nissan, Asahi, Lee Enterprises, Synnovis, and Australia’s Court Services Victoria. The group’s involvement in the Check Point VPN attacks underscores the growing threat of ransomware actors exploiting critical infrastructure vulnerabilities.

Australian real estate agency Harcourts said it suffered a cyber attack that exposed the personal information of tenants, landlords, and trades people. An "unknown third party" had accessed its rental property database and exposed information including full name, age, email address, home address, copy of signature, phone number, photo identification and bank details for both tenants and landlords and tradespeople.