Simon Property Group listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: United States
• Sector: Financial Services
• Announcement date: November 7, 2025

The Medusa ransomware group has officially listed Simon Property Group on its dedicated leak site. According to the group's announcement, the organization is being targeted in a cyberattack, with the threat actors demanding a significant ransom payment to prevent further action.

Details of the alleged attack

The Medusa group has publicized its claim through its own leak platform, asserting that the incident involving Simon Property Group allegedly occurred on October 28, 2025. The group has publicly announced a ransom demand of 1,200,000 USD from the organization.

Ransomware leak sites function as a public pressure mechanism used by cybercriminal groups. In these scenarios, attackers often use the threat of data exposure to coerce victims into paying large sums of money. The announcement made by Medusa serves as a public notification of their claim, though the specifics of the breach remain tied to the group's own platform and verification processes.

Information regarding the leaked data

At this stage, no specific details have been provided regarding the nature of the data that has allegedly been leaked or is being threatened for release. The available evidence provided by the group consists only of a verification screen used to access the group's leak site, rather than a manifest of stolen files.

• No specific data types have been identified in the listing.

In many modern ransomware campaigns, attackers employ a tactic known as double extortion. This method involves not only encrypting an organization's systems to disrupt operations but also exfiltrating sensitive information. The goal is to threaten the victim with the public release of this data if the ransom is not met, thereby increasing the pressure on the target to comply with the attackers' financial demands.

About Simon Property Group

Simon Property Group is a leading real estate investment trust based in the United States. The company specializes in the development and management of shopping malls, outlet centers, and lifestyle destinations globally.

Risk assessment and organizational implications

Given the documented history of double-extortion tactics utilized by the Medusa group, there is a potential risk that sensitive organizational data could be leaked. Because Simon Property Group is based in the United States, any potential data breach could trigger complex legal proceedings under relevant state laws and federal regulations.

The exposure of sensitive information, such as employee or customer data, can lead to significant secondary risks. These include the potential for identity theft or the launch of targeted phishing attacks against the individuals whose data is compromised. Furthermore, the group's past activities suggest a pattern where data is published if the ransom demand is not satisfied, which could result in lasting negative impacts on the organization's commercial reputation.

For organizations operating within the financial and real estate sectors, maintaining robust cybersecurity defenses is critical. Common defensive strategies often include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security audits. Additionally, monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection regulations are essential steps for mitigating the impact of such high-stakes extortion attempts.