Highmark Companies listed on Play ransomware leak site

• Ransomware group: Play
• Country: United States
• Sector: Professional Services
• Announcement date: November 20, 2025

Highmark Companies targeted by Play ransomware group

Highmark Companies has been listed on the leak site operated by the Play ransomware group, following allegations of a data breach. The announcement, which appeared on the group's platform on November 20, 2025, suggests that the organization has fallen victim to a cyberattack. This listing serves as a public claim by the threat actors, signaling that they may proceed with the publication of stolen data as part of their operational tactics.

Details of the alleged attack

According to the claims made by the Play ransomware group, the compromise of Highmark Companies occurred on November 11, 2025. By listing the organization on their leak site, the group is utilizing a method consistent with double-extortion tactics. In such scenarios, threat actors do not merely encrypt an organization's systems to demand a ransom for decryption; they also steal sensitive information and threaten to release it publicly unless the ransom is paid. This dual pressure is designed to maximize the leverage held by the attackers over the victim organization.

The Play group, which has been active since 2022, is known for employing these complex double-extortion methods. The group's operational nature is characterized as being relatively closed, which often implies that any potential negotiation processes following such a listing may be highly complex and difficult for the targeted entity to navigate.

Information regarding compromised data

At this stage of the incident, no specific details or sample files regarding the nature of the compromised data have been provided by the attackers. The listing does not specify the volume of data stolen or the specific types of files that have been accessed. Consequently, the listing names no specific data types that have been affected by the alleged breach.

About Highmark Companies

Highmark Companies is a business entity based in the United States that provides various professional services. As an organization operating within the professional services sector, the security of its data is paramount to its operations and its relationship with clients.

Potential risks and implications

This incident suggests that the organization's sensitive data may have been accessed by unauthorized parties. Should the stolen data be published by the Play group, it could lead to significant downstream risks, such as identity theft or the launch of targeted phishing campaigns against the organization's employees and customers. Such campaigns often use leaked information to craft highly convincing messages to trick individuals into revealing further credentials or funds.

Furthermore, because Highmark Companies is based in the United States, a confirmed data breach may trigger various legal and regulatory obligations. Depending on the nature of the data and the jurisdiction, the organization may face notification requirements under relevant state laws and federal regulations. Organizations in the professional services sector often implement defensive measures such as multi-factor authentication, robust encryption, and continuous monitoring to mitigate these types of risks. However, the threat of data publication remains a significant challenge for modern enterprises facing sophisticated ransomware groups.