Claim: 166,571-row database of Smith Douglas Homes offered for sale
A threat actor claims on an underground forum to sell a database attributed to Smith Douglas Homes, a publicly traded US homebuilder: 166,571 contact rows plus a sales leads table, with names, emails, phone numbers, addresses and web activity data. The claim has not been independently verified and the company has not confirmed an incident. According to DailyDarkWeb, homebuyer data fuels real estate wire fraud, calling for warnings against fake closing and deposit emails.
What happened
A threat actor announced on an underground forum the sale of a database attributed to Smith Douglas Homes, a publicly traded US homebuilder based in Woodstock, Georgia. The listing cites 166,571 contact rows plus a sales leads table, with full names, emails, phone numbers and addresses. The claim is unverified and the company has not confirmed an incident.
Why it matters
If confirmed, the leak exposes homebuilder customer and prospect data. Home buyers are prime targets of real estate wire fraud, via fake closing, deposit or builder emails, which hits people on the list and brand trust. Today, however, only the attacker's claim exists, with no independent verification.
What to do
Monitor the claim and any official statement from Smith Douglas Homes. If the list circulates, prepare a customer advisory about fake closing and payment emails. Review access to the sales CRM and log the case in the incident response process.
For the technical team
- Affected
- Smith Douglas Homes, construtora americana de casas com ações negociadas em bolsa, sediada em Woodstock, Geórgia · Database attributed to Smith Douglas Homes: 166,571 contact rows plus a sales leads table, with full names, emails, phone numbers, addresses (street, city, state, postal code), lifecycle stage, community and division interest, sales call attempts and web activity data.
- Exploitation
- Underground forum sale claim reported by DailyDarkWeb; not independently verified; the company has not confirmed an incident.
- Fix
- No fix applicable; verification and official statement pending.
- Vector
- Alleged sales CRM data leak; component and compromise path not described in the source.
- More details
- DailyDarkWeb analyst note: data looks like CRM on homebuyer prospects; expect fake closing, deposit or builder emails targeting people on these lists. Full source is subscribers-only.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
