HighWire Press Listed by hellcat Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target infrastructure that underpins research, publishing and professional knowledge sharing, treating internal systems as leverage rather than merely as sources of payment-card or consumer data. Against that backdrop, HighWire Press was listed on 18 March 2025 by the group known as hellcat, which claims to have exfiltrated internal files in a ransomware attack.

Public detail remains limited: the number of people affected is unknown, and independent confirmation of the intrusion has not been released. What is known comes from the group’s own leak-site posting, which asserts possession of sensitive material belonging to a platform that serves scholarly publishers. For anyone whose work or personal information may have passed through HighWire systems, the listing is a signal to treat the claim seriously while awaiting fuller disclosure.

Breaking down the breach

On 18 March 2025, HighWire Press appeared on the leak site operated by the hellcat ransomware group. The group’s accompanying statement, signed in characteristic style, asserts: “We hold sensitive data from HighWire Press, a leading platform serving scholarly publishers. The data includes internal documents, communications, and materials that could impact both HighWire and its publishing partners.” The listing characterises the incident as a ransomware attack in which internal files were exfiltrated.

No further technical detail has been made public. The precise date of initial access, the method of entry, the volume of data taken, and whether encryption of production systems occurred are all undisclosed. The number of individuals whose information may be involved is likewise unknown. At present the only concrete assertion is the group’s claim that internal files were removed and are being held.

Who is hellcat?

Hellcat is a ransomware operation that follows the now-familiar double-extortion model: data are stolen before systems are encrypted, and the threat of public release is used to pressure victims. Like other groups of its type, hellcat maintains a leak site on which it posts victim names, sample files and countdown timers. The group has previously listed organisations across multiple sectors, typically framing its claims around the sensitivity of the material it says it holds rather than around consumer payment data alone.

In this case the listing itself constitutes an unverified claim. Hellcat asserts that it possesses HighWire Press material and that the material includes internal documents and communications; those assertions have not been independently confirmed in the public record. The group’s operational pattern, however, is well documented: once a victim is named, the group may release further samples or full archives if negotiations stall.

HighWire Press and its sector

HighWire Press operates as a technology platform that supports scholarly publishers. Organisations of this kind typically host journal content, manage manuscript submission and peer-review workflows, store editorial correspondence, and maintain access-control and subscription systems for academic and professional readers. They sit at the intersection of research institutions, commercial publishers and libraries, handling both published literature and the internal processes that produce it.

A breach affecting such a platform is consequential because the data environment often contains more than finished articles. Editorial discussions, reviewer identities, pre-publication manuscripts, contractual arrangements with partner publishers, and staff or author contact details can all reside on the same infrastructure. Compromise therefore risks not only operational disruption but also the exposure of material that academic and commercial partners regard as confidential.

What was likely exposed

The only data types named in the public claim are “internal files,” further described by the group as internal documents, communications, and materials that could affect HighWire and its publishing partners. No inventory of specific file categories, no count of records, and no confirmation of personal data fields have been released.

Organisations that provide publishing platforms commonly hold staff directories, author and reviewer contact information, manuscript metadata, contractual documents, system configuration files, and internal correspondence. Whether any of those categories were among the files hellcat claims to possess remains unconfirmed. Readers should treat the exact contents as unknown until HighWire Press or an independent investigation provides a verified list.

The real-world impact

For individuals whose details may have been present—authors, reviewers, editors, staff or partner-organisation employees—the primary risks are secondary misuse of contact information, targeted phishing that references genuine internal correspondence, and potential reputational or professional harm if unpublished or sensitive communications surface. Because the scale of the incident is unknown, it is impossible to quantify how many people face those risks.

For HighWire Press and its publishing partners the consequences include possible operational interruption, the need to notify affected parties under applicable privacy regimes, and the longer-term erosion of trust among institutions that rely on the platform for confidential workflows. Even if encryption of production systems did not occur, the mere claim of exfiltration can force costly forensic review and contractual notifications.

If your data was in this claimed breach

If you have an account, author profile, or professional relationship with HighWire Press or any publisher that uses its platform, treat the listing as a prompt for basic hygiene. Change passwords on related accounts, enable multi-factor authentication where available, and remain alert for unsolicited messages that reference manuscripts, reviews or internal correspondence. Monitor financial and professional accounts for unusual activity.

You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. That step will not confirm or rule out involvement in this specific incident, but it provides a practical starting point for understanding your wider exposure footprint while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.