Simon Property Group Listed by medusa Ransomware Group

On October 28, 2025, Simon Property Group, one of the largest owners of shopping malls in the United States, appeared on the leak site of the Medusa ransomware group. The attackers claim to have exfiltrated internal files from the Indianapolis-based real estate investment trust, which operates hundreds of Premium Outlets, Mills centers, and other retail properties visited by millions of shoppers each year.

What's Publicly Reported from Reporting

Public reporting indicates that Simon Property Group was listed on the Medusa ransomware leak site on October 28, 2025. The company has not yet issued a detailed public statement confirming the breach or the volume of data involved. Available reporting describes the incident as a ransomware attack in which internal files were exfiltrated. The exact number of individuals whose personal information may have been exposed remains unknown at this time. Simon Property Group manages properties across the United States and internationally, meaning customer, tenant, vendor, and employee records could potentially be affected depending on what the stolen files contain.

Why This Matters for You and Your Family

When a company the size of Simon Property Group suffers a breach, ordinary people who shop at its malls, sign leases, apply for jobs, or attend events there can find their information caught up in the leak. Internal files often hold names, addresses, phone numbers, email addresses, dates of birth, and sometimes Social Security numbers or financial details. Once that data reaches a ransomware group’s leak site, it can be downloaded by identity thieves, fraudsters, and doxxers within hours. For you and your family, this means a heightened risk of account takeovers, tax fraud, loan applications in your name, or unwanted exposure of where you live and work.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one company. A single exposed email or phone number can be cross-referenced with data from previous breaches to build a complete profile. Attackers link your shopping-mall loyalty account to your child’s gaming username, your spouse’s work email, and your home address. This identity chain makes targeted harassment, swatting, or sophisticated social-engineering attacks far easier. Credential leaks like this one frequently cascade into gaming account takeovers, especially for children who reuse passwords or email addresses tied to family shopping accounts.

Medusa Ransomware Group Track Record

Public reporting attributes the attack to the Medusa ransomware group. The group emerged in 2021 and has since targeted organizations across multiple sectors. Notable prior victims include healthcare providers, technology firms, and other large retailers. Medusa’s typical playbook involves gaining initial access through phishing or exploited remote desktop credentials, exfiltrating sensitive files before encrypting systems, and then pressuring victims with threats to publish the stolen data on their leak site if ransom demands are not met. Their extortion style combines data leaks with distributed denial-of-service attacks in some cases.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what chains back to the Simon Property Group breach.
• Rotate any password you used on Simon Property Group websites or loyalty programs anywhere else it is reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails exposed in retail breaches.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles for you while you focus on securing your own accounts.

The Simon Property Group listing on the Medusa leak site is a reminder that retail and real estate giants hold data that directly affects everyday families. Taking concrete steps now can limit how far this claimed breach travels. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, including protection for your family’s gaming accounts that are often the next link in the doxxing chain.