Ransomware Group Helix Claims Attack on Smith Douglas Homes
The group posted what it says are records from the US homebuilder on its dark-web listing site. Smith Douglas Homes has not confirmed any incident.
Key points
- Helix, a ransomware group, listed Smith Douglas Homes on its dark-web leak site on 17 October 2026, claiming to hold the company's records.
- The group's post cites an annual revenue figure of roughly $971 million, a detail written by the attackers to add pressure and not independently verified.
- Smith Douglas Homes has not publicly confirmed any incident, and the claim could not be verified at publication time.
- Threat Vectr's leak-site tracking has recorded 2 stories tagged to Helix, first covered 9 July 2026.
- Professional Services is the sector most commonly targeted in Helix's claimed attacks, though the group has listed victims across 7 industries.
A ransomware group calling itself Helix has listed US homebuilder Smith Douglas Homes on its dark-web leak site, first observed by the monitoring service Ransomware.live on 17 October 2026. Ransomware is malicious software criminals use to lock a company's files and demand payment; the leak site is a separate pressure tactic, threatening to publish stolen data unless the victim pays.
The listing was written by the attackers. It claims yearly revenue of around $971 million and warns that download links to allegedly stolen records would unlock within 12 hours of posting. Listings like this are designed to frighten victims into paying fast. They're sometimes exaggerated, occasionally false.
Smith Douglas Homes, a publicly traded homebuilder based in Georgia, has not confirmed any breach. The claim could not be independently verified at publication.
How active is Helix?
Helix isn't a one-off group. We first covered it on 9 July 2026, and it has appeared across 7 sectors, with Professional Services firms targeted most often. Whether its claimed attacks translate to real data theft at the scale advertised is a separate question from the listing itself. Ransomware.live's tracking and our own coverage both treat these as unverified claims until a company confirms otherwise.
Should you worry?
Until Smith Douglas Homes makes a formal statement, the sensible steps are limited but worth taking.
Watch for phishing emails: criminals send fake messages pretending to be the company or a related business, using news like this to steal passwords or personal details. Change any account password you hold with the company, and don't reuse it elsewhere. Any call offering "breach compensation" or asking you to confirm personal details is almost certainly fraud. Scammers routinely attach themselves to unconfirmed breach reports to run exactly that scheme.
No regulator has announced enforcement action tied to this listing. In the US, the Federal Trade Commission oversees breach-notification requirements for many consumer-facing businesses, and state attorneys general hold authority under individual state laws. Whether any notification obligation is triggered depends entirely on what, if anything, was actually taken, and that remains unestablished.
Common questions
Has Smith Douglas Homes confirmed a breach?
No. The company has made no public statement, and the claim could not be independently verified at publication.
Who is Helix?
Helix is a criminal ransomware group that runs a dark-web site naming companies it claims to have attacked. Its sector focus and listing pace put it among the active groups Threat Vectr currently tracks.
