On February 23, 2024, UK property developer Acorn Property Group appeared on the Medusa ransomware leak site, claiming that the company had been hit by a ransomware attack in which internal files were exfiltrated. The firm, founded in 1995 and based at 28 Headland Rd, Newquay, Cornwall, specialises in property development and investment across the UK. The exact number of people whose data may have been exposed remains unknown, as neither the leak-site listing nor any subsequent company statement has quantified affected records.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Acorn
Get alerted the next time Acorn files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Acorn’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details from the Medusa Listing
The Medusa leak site states that Acorn suffered a ransomware incident and that attackers successfully exfiltrated internal files. The listing does not specify the volume or exact categories of data taken, nor does it publish sample files at the time of the initial disclosure. Public mirrors of the site, such as ransomware.live, state the entry was first visible on 23 February 2024. The disclosure indicates that negotiations between the attackers and the company either failed or never occurred, a common trigger for data publication on these platforms.
Why This Matters for You and Your Family
When a property company like Acorn is breached, the information at risk often includes personal details of customers, tenants, contractors, and employees. This can mean names, addresses, phone numbers, email accounts, financial references, or copies of identification documents used during tenancy or purchase processes. For ordinary families who have bought, rented, or worked with Acorn over the past three decades, the exposure creates a persistent risk of identity theft, phishing, and unwanted contact. Even if the precise data types are not yet public, the claimed exfiltration of internal files means you should treat your information as potentially compromised if you have had any business relationship with the firm.
Doxxing and Identity-Chain Risks
Property records are particularly dangerous in doxxing chains because they directly link real-world addresses, legal names, and financial histories. Attackers or opportunistic criminals can combine leaked internal files with publicly available land-registry data, social-media profiles, and other breach records to build detailed dossiers. A single exposed email or phone number from this incident can be used to reset accounts on banking, email, or government services. Credential leaks like this one cascade into account takeovers, including gaming platforms where children often reuse passwords or email addresses tied to family accounts. The result is a widening web of exposure that can affect every member of a household long after the initial breach is forgotten.