HMA Listed by play Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 13, 2026, the ransomware group Play listed HMA on its leak site and stated that internal files had been taken from the organization. The number of people affected is not known, and no further details about the volume of data or the circumstances of the incident have been released publicly. The event fits a pattern seen across multiple sectors in which groups publish victim names after claiming data exfiltration, leaving affected organizations and individuals with limited verified information.

What happened

The incident was reported on February 13, 2026, and centers on HMA, an organization located in the United States. Available information indicates that internal files were exfiltrated during a ransomware attack. No additional facts have been provided about when the intrusion occurred, how access was obtained, or how many records were involved.

The group behind it: play

Play is a ransomware operation that has conducted multiple campaigns since at least 2022. Public reporting describes the group as using encryption paired with data theft, followed by listings on a dedicated leak site when ransom demands are not met. The group claims responsibility for the HMA incident through that site; independent verification of the claimed exfiltration or its scope is not available from disclosed facts.

About HMA

HMA operates as an organization in the United States. Entities in comparable sectors routinely manage customer account information, network configuration details, and internal operational records. A compromise at such an organization can expose both business processes and any data entrusted to it by users or partners, increasing the potential reach of any subsequent misuse.

The information in question

The only detail released states that internal files were exfiltrated. No specific categories of data, such as customer records or technical documents, have been identified. Organizations of this type commonly hold user credentials, billing information, and system logs, yet the precise contents of the claimed exfiltration remain unconfirmed.

The real-world impact

Individuals connected to HMA face the possibility that any personal or account-related material contained in the files could be used for targeted follow-on activity, including credential stuffing or social engineering. For the organization, the incident adds to operational costs associated with investigation, potential regulatory review, and restoration of systems. Because the scale and exact nature of the data remain undisclosed, the full extent of these risks cannot yet be measured.

Were you affected?

Begin by monitoring official statements from HMA for any confirmation or guidance. Change passwords for any accounts linked to the organization and enable multi-factor authentication where available. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.