Hull Property Group Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a company that manages shopping centres and retail properties appears on a ransomware group's leak site, the practical question for ordinary people is straightforward: could internal files that mention tenants, employees, contractors or customers now be in someone else's hands? Public detail on this incident is limited, but the listing alone is enough to warrant clear information about what is known and what is not.

On or around 5 April 2023, Hull Property Group was listed by the alphv ransomware group, which claimed that internal files had been exfiltrated in a ransomware attack. The number of people affected has not been disclosed, and the precise contents of those files remain unconfirmed beyond the group's general claim.

Inside the incident

According to the available record, Hull Property Group was named on alphv's leak site in a report dated 5 April 2023. The group claimed that internal files were taken during a ransomware attack. No public confirmation of the attack method, the exact date of intrusion, the volume of data, or any ransom demand has been provided in the facts available here. The number of individuals whose information may have been involved is listed as unknown.

Ransomware incidents of this type typically involve unauthorised access followed by both encryption of systems and theft of data for leverage. In this case, only the claim of exfiltration of internal files is stated. Whether systems were encrypted, whether a ransom was paid, or whether any data was later published has not been detailed in the public summary relied upon for this account. Readers should treat the leak-site listing as an unverified claim by the threat actor unless independently confirmed by the organisation or by regulators.

Who is alphv?

Alphv, also widely known in public reporting as BlackCat, is a ransomware operation that emerged in the early 2020s and has been documented as a ransomware-as-a-service (RaaS) group. Affiliates deploy the malware against organisations across many sectors; the core operators typically handle negotiations and leak-site infrastructure. The group has been associated with double-extortion tactics: encrypting victims' systems while also copying data and threatening to publish or sell it if payment is not made.

Public reporting over several years has linked alphv to attacks on companies in healthcare, manufacturing, government contractors and professional services, among other fields. The group has used a dedicated leak site to name victims and, in some cases, to release samples or larger sets of stolen files. Those listings are claims by the actors themselves. For this Hull Property Group matter, the facts state only that the organisation was listed and that internal files were claimed to have been exfiltrated; no further specific assertions by alphv about this victim are included in the record used here.

Hull Property Group and its sector

Hull Property Group is described in its own public materials as a full-service retail real estate company headquartered in Augusta, Georgia. Founded in 1977 by James M. Hull, it has grown into one of the larger privately owned retail real estate firms in the United States, with an owned portfolio reported in excess of 16 million square feet. The company focuses on enclosed malls and surrounding retail nodes and works across departments and locations to improve those properties and the communities they serve.

Retail real estate operators routinely hold a mix of commercial, operational and personal data. That can include lease and tenant records, employee and payroll information, vendor and contractor details, financial and banking correspondence, security and access-control data, and sometimes customer or marketing lists tied to mall events or services. A breach affecting such an organisation matters because the data often spans many third parties—tenants, staff, suppliers and local partners—who may have no direct relationship with the company's IT systems yet still appear in its files.

What was likely exposed

The facts name the exposed material only as "internal files exfiltrated in a ransomware attack." No inventory of file types, no record counts and no confirmation of specific personal-data categories have been disclosed publicly in the material available for this article. Exact contents therefore remain unconfirmed.

Organisations of this kind typically maintain:

• Employee records, including contact details, identification documents and payroll-related information
• Tenant and lease files, which may contain business and personal contact data, financial terms and correspondence
• Vendor, contractor and service-provider agreements and invoices
• Internal financial, legal and operational documents
• Occasionally visitor, marketing or customer-event lists connected to retail properties

None of the above should be read as a confirmed list of what was taken in this incident. They are the categories such a business ordinarily holds; only the threat actor's broad claim of internal-file exfiltration is on record.

What's at stake

For individuals, the main risks are familiar but still serious: phishing or social-engineering attempts that reference real internal details, identity fraud if identity documents or financial data were present, and long-term exposure of contact or employment information. Tenants and smaller business partners may face commercial sensitivity issues if lease terms, correspondence or banking details were among the files. Because the scale and exact data types are unknown, people connected to Hull Property Group—current or former staff, tenants, vendors—cannot yet rule themselves in or out with certainty.

For the organisation, a ransomware listing can mean operational disruption, investigatory and legal costs, notification duties where personal data is involved, and reputational harm with partners and communities. None of these outcomes is asserted here as having already occurred; they are the ordinary consequences that follow when internal files are claimed to have left an organisation's control.

Were you affected?

If you are a current or former employee, tenant, contractor or other party who has shared personal or business information with Hull Property Group, treat the situation as a prompt for ordinary caution rather than panic. Monitor financial and email accounts for unexpected activity, be wary of unsolicited messages that appear to reference company business, and consider placing fraud alerts with credit bureaus if you believe sensitive identity data could have been involved. Official notifications, if required and if personal data was confirmed stolen, would normally come from the organisation or from regulators; none are detailed in the facts used for this article.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step does not confirm or deny involvement in this specific incident, but it can show whether your details have surfaced elsewhere and help you prioritise further protections such as password changes and multi-factor authentication.

AICompiled with AI assistance from public sources and published under our editorial standards.