HMP Global Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

HMP Global, a long-standing organiser of medical education events, was listed by the qilin ransomware group on or around 14 October 2025. Public reporting indicates that internal files were exfiltrated during a ransomware attack; the number of people affected remains unknown and further technical details have not been disclosed.

The listing itself is a claim by the group rather than an independently verified confirmation of full compromise. For an organisation that convenes large professional audiences in mental health and wound care, any exposure of internal material raises practical questions about the security of operational data and the potential knock-on effects for partners and attendees.

Inside the incident

According to available public information, HMP Global was named on a qilin-associated leak site with the assertion that internal files had been taken in a ransomware incident. The report date associated with the listing is 14 October 2025. No official statement from the company detailing the timeline, initial access method, encryption status, or exact volume of data has been incorporated into the public record used here. The number of individuals whose information may have been involved is listed as unknown. Beyond the characterisation “internal files exfiltrated in ransomware attack,” no further breakdown of systems, file counts, or recovery status has been released in the source material.

The group behind it: qilin

Qilin, also tracked in security literature as Agenda, is a ransomware-as-a-service operation that has been active for several years. The group typically employs double-extortion tactics: encrypting systems while simultaneously copying data and threatening to publish it if a ransom is not paid. Affiliates of the service have targeted organisations across healthcare, manufacturing, education and professional services, often advertising victims on dedicated leak sites. Public analyses describe qilin’s use of common initial-access vectors such as compromised credentials or vulnerable remote services, followed by lateral movement and data staging before encryption. In this case the group claims HMP Global as a victim and asserts that internal files were taken; that claim has not been independently corroborated in the facts provided.

HMP Global and its sector

HMP Global has operated for four decades as a producer of medical education brands. Its portfolio includes Psych Congress, described as a leading source for mental-health education, and the Symposium on Advanced Wound Care (SAWC), characterised as the largest wound-care meeting of its kind. The company partners with clinicians, researchers and industry stakeholders to deliver conferences, digital content and related professional resources. Organisations of this type routinely manage attendee registration lists, speaker materials, sponsorship contracts, internal correspondence and operational databases. A ransomware incident affecting such an entity is consequential because the data held can include professional contact details, proprietary educational content and commercial agreements whose unauthorised release could disrupt events, damage partner trust or expose individuals to secondary risks such as phishing.

What data was at risk

The only data type explicitly named in the available facts is “internal files” said to have been exfiltrated. No inventory of file categories, record counts or specific personal identifiers has been published. Organisations that run large medical conferences typically store registration information, email addresses, institutional affiliations, payment or invoice records, and internal planning documents. Whether any of those categories were among the files taken remains unconfirmed. Because the precise contents have not been disclosed, it is not possible to state with certainty what personal or commercial information, if any, left the organisation’s control.

The real-world impact

For individuals whose details may have been present in internal systems, the principal risks are opportunistic misuse of contact information for phishing or social-engineering attempts and, if financial or identity-related records were involved, potential fraud. For HMP Global itself, the incident can produce operational disruption, legal notification obligations, reputational pressure from partners and the need to rebuild trust with the clinical communities it serves. Until more definitive information is released, the scale of these effects cannot be quantified. The absence of a confirmed headcount of affected people means that both the company and any potentially exposed parties are operating with incomplete visibility.

Were you affected?

If you have registered for HMP Global events, spoken at its conferences, or maintained a commercial relationship with the organisation, treat the possibility of exposure as open until further notice. Practical first steps include:

• Monitor email and financial accounts for unexpected messages or activity that reference medical-education events or wound-care/psychiatry topics.
• Enable multi-factor authentication on professional and personal accounts that share the same credentials you may have used with HMP Global systems.
• Be sceptical of unsolicited requests for payment, login details or personal documents that claim to originate from conference organisers.
• Consider placing a fraud alert with credit-reporting agencies if you believe financial identifiers could have been stored.
• Run a free exposure scan of your email address against known breach corpora to check whether that address has already appeared in other public leak data.

Public detail on this incident remains limited; any additional confirmed information from HMP Global or independent investigators should be reviewed as it becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.