Ben Leeds Properties

We breached Ben Leeds Properties through appfolio. We gained initial access and then began pulling out data over a few days. Then we used the built in ai called Realm X to then exfilitrate work order modules and we have proof of that below are file tree, images and proof of inside access. For the Work Orders module, the AI did not just export a basic list—it extracted a deep, highly detailed operational database spanning up to 15 years. Here is exactly what the AI extracted from the Work Orders Database (packaged across files like work_orders_2016_2017.zip and work_orders_2024_2026.zip): 1. The Core Work Order Identifiers - Unique Work Order IDs: The system-generated internal ticket tracking numbers. - Creation & Completion Timestamps: The precise dates and times tickets were opened, scheduled, updated, and closed. - Priority & Category Tags: Classifications marking the urgency (e.g., Emergency, High, Low) and type of issue (Plumbing, Electrical, Structural, Appliance 2. Physical Access & Property Blueprints - Granular Location Data: Structural mappings linking the ticket to specific building portfolios, physical addresses, and exact Apartment Unit Numbers. - Entry Notes and Gate Codes: The unredacted text fields where tenants or managers explicitly wrote down complex master gate codes, lockbox combinations, or specific instructions on how to bypass security (e.g., "Front door handle won't lock, push hard," or "Gate code #1234 is broken, use side latch"). 3. Detailed Maintenance Descriptions (The Risk Vector) - Full Problem Descriptions: Every qualitative sentence submitted by a tenant describing their physical living conditions, failures, or structural vulnerabilities. - Tenant Access Permissions: Explicit records indicating whether the resident gave management permission to enter the unit while they were away, exposing empty apartment timelines and resident schedules. 4. Vendor, Employee, and Financial Metrics - Assigned Staff & Usernames: The full names and internal employee IDs of the property managers or technicians who created, edited, or resolved the work orders. - Vendor Matrices: Lists of external contractors, emergency locksmiths, or plumbers used by the organization, including their internal Vendor IDs. - Line-Item Cost Data: Detailed data fields logging additional costs, parts costs, total labor time costs, and historical repair billing values for each property portfolio. The following data was stolen: The following data was stolen Financial Ledgers & Master Reports Active Rent Rolls: Master business spreadsheets compiled in three simultaneous formats (.csv, .xlsx, and .pdf). These files contain: - Full legal names of all current residents. - Exact apartment unit numbers. - Precise monthly rent rates. - Lease commencement and expiration dates. - Outstanding late payment balances. Signed Legal Agreements & Resident Packets - Lease Contracts: Original, binding rental agreements containing unredacted handwritten or digital signatures for main tenants. - Parking Space License Agreements: Legal vehicle parking contracts signed by both the 1st and 2nd residents - Liability Waivers: Signed corporate legal release forms. - Pet Addendums: Official signed agreements authorizing specific animals to reside on the premises. Vehicle & Location Identifiers - Parking Logs: Lists linking tenant names and direct email addresses to their specific car models, license plates, and assigned parking spaces. - Initial Inspection Logs: Walkthrough documentation mapping out the exact pre-existing structural flaws, window conditions, and lock statuses of individual units. - Work Order Database (140,139+ logs): A 15-year history (2011–2026) of maintenance request descriptions detailing gate entry codes, broken locks, and apartment access notes. Qualitative & Sensitive Private Records - Move-Out Archives: Sensitive text logs tracking exactly why tenants vacated properties, exposing personal scenarios like evictions, financial hardships, or roommate disputes. - Service Animal Registries: Disability accommodation tracking reports containing the names, ages, and types of service animals (e.g., cats) used by residents. - survey emails Tenant Regulatory Disclosures & Credit Election Forms (PDFs) This section documents completed statutory and regulatory riders compiled directly from individual resident leasing files. Rather than flat database strings, these files consist of actual, completed regulatory documentation generated throughout the tenant onboarding cycle. Core Content Breakdown: - Resident Identities & Multi-Tenant Mappings: Unredacted first and last names of all primary lessees and co-residents listed under a single lease agreement (e.g., Zachariah J. Barber, Maria C. Parco, and Ryan A. Yost). - Direct Telecommunication Identifiers: Active primary phone numbers (e.g., (618) 401-4824) and private consumer email addresses (zachary.j.barber@gmail.com). - Granular Physical Unit Mappings: Precise apartment unit designations (e.g., APT 202) mapped directly to specific property locations managed by the portfolio (e.g., 3327 Livonia Avenue, Los Angeles, CA 90034). -Operational & Financial Timelines: Historic lease initiation dates (09/01/2021) alongside specific contract execution and effective milestones (April 1, 2025). - Credit Bureau Transmission Directives: Individual tenant credit choices, capturing explicit data-sharing selections dictating whether their monthly financial ledgers are pushed out to nationwide credit repositories like Experian. - Corporate System Routing Handles: Property-specific administration email endpoints (e.g., 3327livonia@benleedsproperties.com) used by internal software to route digital accounts. Primary File Identifier Example: - AB2747_Addendum.pdf (California Positive Rental Credit Reporting Election Form) Final Compressed Size (Packed): 15,893,414 bytes (exactly 15.16 MB on disk). Total Uncompressed Size: 117,940,382 bytes (exactly 112.48 MB of raw text, spreadsheets, and legal documents when completely extracted). UPDATE 9-21-26: At the time of writing this we no longer have access to this company. This company failed to negotiate starting at $250,000 and decided to take it into there own hands. This company definitely get's what they deserved.