Leak sites are advertising key maps now, not just file servers

Leak sites had a busy 48 hours. Treat every listing as a claim until the victim or a regulator confirms it. The useful part is the shopping list the crews advertise, because it tells you what they think they can sell.

When the haul is keys, not files

On September 15 the group tracked as ShadowByt3$ listed HandyTrac, a property key-control product tied in public reporting to a Greystar site in Litchfield Park, Arizona. The post claimed physical-to-digital key maps, a "property intelligence and vulnerability" file, employee identity data, invoices, and admin-portal access. They gave a 72-hour clock.

We have not seen an official HandyTrac or Greystar confirmation as of this writing. Even as a claim, the contents are the point. A digital key map is a walk-through of who can open which door. Pair that with a vulnerability log and you do not need ransomware to hurt a property. You need a van.

That is the same problem we keep seeing on contractor yards: cameras and locks without a plan for who holds the evidence, and software that turns physical access into a spreadsheet. If your yard or building uses a key-control or access SaaS, ask where the maps live, who can export them, and whether that tenant is segmented from the rest of the company's mail.

Canadian names on the same kind of list

This month's leak sites also named Canadian firms. Storm listed Lowerys, a century-old Thunder Bay company that sells office goods and managed IT, on September 7. Settra listed Teletek Structures of St. Jacobs, Ontario, a tower engineering shop that works with major carriers, around September 3. Krybit listed Metalware Corporation, a Canadian industrial shelving maker, on September 12. None of those listings were independently confirmed in the public reporting we reviewed. Groups inflate claims to force a call.

The pattern still matters for mid-size Canadian operators. An MSP with remote tools is a multiplier. An engineering contractor holds drawings and site access details for someone else's network. A plant holds vendor files and shop-floor accounts. Storm showing up on both a Florida credit union listing (Insight Credit Union, claimed September 15) and a Thunder Bay MSP listing is a reminder that the brand on the leak site is not choosy about sector.

What we would ask this week

• If you use a key-control, lockbox, or camera cloud, who can export the map, and is that account on MFA that is not SMS to a shared phone?
• If an MSP or a tower contractor has a standing remote session into your environment, can you revoke it without calling someone who is on holiday?
• Backups: last proven restore, and whether the same admin who runs production can delete the copies. A leak-site week is a restore-test week.
• Do not pay a leak site to "confirm." If you are named, call counsel and your insurer, preserve logs, and treat the claim as an incident until you can disprove access.

Bottom line

Extortion crews now advertise door schedules the same way they advertise file servers. Forensic Five reviews websites, yards, and backups for Canadian organizations that need a written answer, not a dashboard. From St. Albert, Alberta. Claims are cheap. Restore tests are not.