Highwoods Properties data allegedly listed by Helix ransomware group

• Ransomware group: Helix
• Country: United States
• Announcement date: August 7, 2026

Helix ransomware group claims data breach at Highwoods Properties

The ransomware group known as Helix has listed data allegedly belonging to Highwoods Properties on its leak site. This announcement, made on August 7, 2026, claims that the group has successfully compromised the organization's digital environment. While the group has made these claims publicly, the incident remains an allegation from the threat actor.

Details of the alleged attack

According to the announcement made by the Helix group, the stolen data is claimed to have been obtained from the SharePoint libraries of Highwoods Properties. The group has employed a specific method for releasing the stolen information, utilizing a staged approach. The group announced that it has categorized the data into various stages, ranging from T1 to T4, based on their perceived sensitivity levels.

This staged release mechanism is designed to increase pressure on the target organization. The group stated that files within these categories become accessible to the public as specific countdown timers expire. This tactic is a hallmark of a double-extortion strategy, a common method used by modern ransomware groups. In such scenarios, attackers do not just encrypt a company's systems but also steal sensitive information, using the threat of public exposure to demand payment. By releasing data in waves, the attackers aim to maximize psychological and operational pressure on the victim.

Scope of the compromised data

The leak announcement claims that a wide variety of directories and information types have been compromised. The group asserts that the breach includes access to the Entra environment and various email contents. The specific types of data mentioned in the listing include:

• Email contents
• Development documents
• Property management data
• Marketing files
• Entra directory information

The presence of directory information and email contents is particularly concerning for organizational security. Such data can be leveraged by threat actors to conduct highly targeted phishing attacks against employees or to facilitate secondary identity theft attempts. The inclusion of property management and development documents suggests that the breach may impact core business operations.

About Highwoods Properties

Highwoods Properties is a publicly traded real estate investment trust (REIT) that develops, acquires, owns, and operates office properties in the United States. The company focuses on a portfolio concentrated in high-growth Sun Belt markets.

Risk assessment and organizational implications

This leak claim indicates that sensitive corporate data and employee information within Highwoods Properties may be at risk of exposure. The alleged compromise of email and directory information could lead to targeted phishing attacks against employees or secondary identity theft attempts. Furthermore, as a US-based entity, the incident may result in legal consequences under state-level data privacy regulations.

Information regarding the Helix group remains limited, but their method of staged data release suggests a clear intent to pressure the organization through the threat of incremental exposure. The classification of data by sensitivity levels suggests that the risk to the organization's operational security may be significant.

For organizations operating in similar sectors, such incidents highlight the importance of robust defensive measures. Protecting SharePoint environments, implementing strict access controls for directory services like Entra, and monitoring for unauthorized data exfiltration are critical components of a modern security posture. Additionally, because data breaches can lead to regulatory scrutiny, maintaining comprehensive logging and incident response plans is essential for managing the legal and operational fallout of a potential compromise.