Highwoods Properties

Highwoods Properties was compromised in a ransomware attack attributed to helix in August 2026. The organization, operating in the Other sector in United States, was added to the group's data leak site as part of an extortion campaign.

helix operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

SharePoint libraries staged T1 (least) → T4 (most). Release countdown live on Helix. Tiers unlock by stage when each set timer reaches 0.