RE/MAX Hit by Cyberattack, Customer Data Exposed in Extortion Attempt RE/MAX Southern Africa has confirmed a cyberattack that resulted in the exposure of customer data, following an extortion attempt by a hacker group. The incident, detected on 5 March 2026, involved unauthorized access to internal systems via a brute-force attack followed by SQL injection, allowing threat actors to extract and delete sensitive information. In an email obtained by Business Report, the hacker identifying as part of "Team Cyber Strike" claimed to have stolen 291GB of data, including backups of deleted files and AWS S3 bucket contents. The group demanded payment, stating, "Please let us know your offer," but RE/MAX rejected the blackmail attempt, reaffirming its refusal to negotiate with criminals. In a statement to franchisees, CEO Adrian Goslett acknowledged the breach, confirming that attackers accessed personal data, including identifying numbers, email addresses, physical addresses, phone numbers, ages, and transaction-related documents (e.g., OTPs, commission records). While no data was permanently lost thanks to successful recovery from backups the company is conducting a detailed impact assessment to determine the full scope of exposed information. RE/MAX’s response included: - Engaging external forensic specialists and legal counsel to investigate the breach. - Restoring affected systems from backups and stabilizing operations. - Strengthening access controls, rotating credentials, and notifying regulatory authorities. - Reviewing AWS activity logs and conducting device-level forensic imaging for IT personnel with S3 access. The company emphasized that the attack reflects the growing sophistication of cyber threats across industries, not a failure of its security measures. Preliminary findings suggest the breach may have enabled identity theft, fraud, or reputational harm for affected clients, though the exact categories of compromised data are still under review. RE/MAX has since resumed full operations, with ongoing efforts to enhance its security posture in response to the incident.