Washington Prime Group Data Breach Exposes Sensitive Customer Information
Washington Prime Group Holdings L.P. (WPG), a major U.S. real estate investment trust (REIT) managing 73 retail properties across 27 states, confirmed a significant data breach in September 2025. The incident came to light after the hacking group Worldleaks claimed responsibility, leaking stolen data on the Tor network on September 23, 2025. The breach was formally disclosed to the Massachusetts Attorney General’s office on December 23, 2025.
The exposed data may include financial account information and Social Security numbers, though the full scope remains under investigation. At least six Massachusetts residents were initially confirmed as affected, with impacted individuals notified by mail. The total number of victims could rise as the investigation continues.
WPG, headquartered in Columbus, Ohio, operates over 39 million square feet of retail space, including enclosed malls and open-air shopping centers, serving millions of annual visitors. The breach raises concerns about the security of sensitive customer data held by large retail property operators.
Shamis & Gentile P.A., a law firm specializing in data breach litigation, is investigating potential legal action for affected individuals, citing possible compensation for damages, including out-of-pocket expenses and identity theft-related losses. The firm has encouraged impacted parties to monitor financial accounts and consider credit monitoring services.
Source: https://www.claimdepot.com/investigations/washington-prime-group-data-breach-2025
Washington Prime Group Inc. cybersecurity rating report: https://www.rankiteo.com/company/washington-prime-group-inc
Washington Prime Group Inc. cybersecurity rating report: https://www.rankiteo.com/company/washington-prime-group-inc
"id": "WASWAS1766527676",
"linkid": "washington-prime-group-inc, washington-prime-group-inc",
"type": "Breach",
"date": "9/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'At least six individuals in '
'Massachusetts (subject to '
'change)',
'industry': 'Retail Properties',
'location': 'Columbus, Ohio, USA',
'name': 'Washington Prime Group Holdings L.P.',
'size': '73 properties in 27 states, over 39 million '
'square feet',
'type': 'Real Estate Investment Trust (REIT)'}],
'customer_advisories': 'Affected individuals notified by mail; advised to '
'monitor accounts and use identity protection services',
'data_breach': {'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Financial account information',
'Social Security numbers']},
'date_detected': '2025-09-23',
'date_publicly_disclosed': '2025-12-23',
'description': 'Shamis & Gentile P.A. is investigating the Washington Prime '
'Group Holdings L.P. data breach. Sensitive personally '
'identifiable information may have been exposed, and affected '
'individuals may be eligible for compensation.',
'impact': {'data_compromised': 'Sensitive personally identifiable '
'information, financial account information, '
'Social Security numbers',
'identity_theft_risk': 'High',
'payment_information_risk': 'High'},
'investigation_status': 'Ongoing',
'recommendations': ['Sign up for free Experian IdentityWorks credit '
'monitoring and identity restoration services',
'Monitor financial statements regularly for suspicious '
'activity',
'Place a fraud alert and request free credit reports from '
'major credit bureaus',
'Seek legal help to understand rights and pursue '
'compensation'],
'references': [{'source': 'Shamis & Gentile P.A.'}],
'regulatory_compliance': {'regulatory_notifications': 'Disclosed to the '
'Massachusetts Attorney '
'General’s office'},
'response': {'communication_strategy': 'Notification by mail to affected '
'individuals',
'third_party_assistance': 'Experian IdentityWorks credit '
'monitoring and identity restoration '
'services'},
'threat_actor': 'Worldleaks',
'title': 'Washington Prime Group Holdings L.P. Data Breach',
'type': 'Data Breach'}