A Lisbon real-estate company has appeared in a ransomware victim listing, but the technical lesson is about how extortion crews use claim pages, not just encryption, to pressure targets.