Summary
Written by ThreatClusterfrom site fields, victim profile, leak post, screenshotHelix claims Highwoods Properties’ data has been leaked in staged packages (T1–T4) for SharePoint libraries and related data. The leak page shows a countdown to release, with a timer reading 00 Days 00 Hours 00 Mins 00 Secs and notes that later stages unlock on schedule. SharePoint is the platform named on the leak page.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Platforms
- SharePoint Entra
What was taken
SharePoint libraries staged T1 (least) → T4 (most). Release countdown live on Helix. Tiers unlock by stage when each set timer reaches 0.
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- label
- Countdown until T1 releases; later stages unlock on schedule.
- value
- Countdown until T1 releases; later stages unlock on schedule.
- countdown_display
- Countdown until T1 releases; All stages unlocked; Stage packages unlock when each timer hits zero.
- All stages released
- Yes
- Least → most sensitive
- Least → most sensitive:\nT1 Least → T2 Low → T3 High → T4 Most.
- Stage packages unlock when each timer hits zero.
- on_page
- Inventory visible and downloads follow each stage
- Entra + inventory visible; downloads follow each stage.
- SharePoint libraries · T1 (least) → T4 (most).
- Stage packages unlock when each timer hits zero.
- Entra + inventory visible; downloads follow each stage.
- on_page
- Countdown until T1 releases; later stages unlock on schedule.
- page text
Leak-site images (1)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.