Washington Prime Group Data Breach Exposes Sensitive Customer Information Washington Prime Group Holdings L.P. (WPG), a major U.S. real estate investment trust (REIT) managing 73 retail properties across 27 states, confirmed a significant data breach in September 2025. The incident came to light after the hacking group Worldleaks claimed responsibility, leaking stolen data on the Tor network on September 23, 2025. The breach was formally disclosed to the Massachusetts Attorney General’s office on December 23, 2025. The exposed data may include financial account information and Social Security numbers, though the full scope remains under investigation. At least six Massachusetts residents were initially confirmed as affected, with impacted individuals notified by mail. The total number of victims could rise as the investigation continues. WPG, headquartered in Columbus, Ohio, operates over 39 million square feet of retail space, including enclosed malls and open-air shopping centers, serving millions of annual visitors. The breach raises concerns about the security of sensitive customer data held by large retail property operators. Shamis & Gentile P.A., a law firm specializing in data breach litigation, is investigating potential legal action for affected individuals, citing possible compensation for damages, including out-of-pocket expenses and identity theft-related losses. The firm has encouraged impacted parties to monitor financial accounts and consider credit monitoring services.