Una Seguros Listed by play Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 11, 2022, the insurance organisation Una Seguros appeared on the leak site operated by the ransomware group known as play. The group claims to have stolen internal data in a ransomware attack. Public detail remains limited: the number of people affected is unknown, and no further confirmation of the incident’s scope or method has been widely established beyond the listing itself.

For customers, employees and partners of an insurer, any claim of internal-file theft raises practical questions about what may have left the organisation’s systems and what steps follow. This account sets out only what has been reported and the established context around the actors and sector involved.

What happened

Una Seguros was listed on the play ransomware leak site on or around December 11, 2022. According to the reported summary, the group claims to have exfiltrated internal files during a ransomware attack. No public figure has been given for the volume of data, the precise date of intrusion, or the technical method used. The number of individuals potentially affected is recorded as unknown. Beyond the leak-site listing and the group’s claim of stolen internal data, further operational details have not been disclosed in the available record.

Who is play?

Play is a ransomware operation that has been active in the public domain for some time. Like other groups in this category, it is known for a double-extortion model: encrypting systems while also copying data and threatening to publish it on a dedicated leak site if payment demands are not met. The group typically posts victim names and, in some cases, sample files to pressure organisations. Its listings are claims made by the actors themselves; they do not automatically constitute independent verification that every asserted detail is accurate. In this instance, the sole public assertion tied directly to Una Seguros is the leak-site listing and the accompanying claim that internal data was stolen. No additional statements by play specifically about this victim appear in the provided facts.

Who is Una Seguros?

Una Seguros is an insurance organisation. Insurers in general collect and retain substantial volumes of personal and commercial information in the ordinary course of underwriting policies, handling claims, and managing customer relationships. That typically includes identity and contact details, policy documents, financial and payment data, health or property information relevant to cover, and internal business records. A breach affecting such an organisation is consequential because the data held is often sensitive, long-lived, and useful for identity fraud, social engineering, or further targeting of individuals and corporate clients. The precise corporate structure, size, or geographic footprint of Una Seguros beyond its identification as the listed entity is not detailed in the available facts.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory—such as customer databases, claims files, employee records, or specific document types—has been named. Because the exact contents remain unconfirmed, it is not possible to state with certainty which categories of information left the organisation. Organisations in the insurance sector commonly hold personal identifiers, policy and claims data, financial particulars, and internal operational documents. Any of those could theoretically be present among “internal files,” yet that remains an inference from sector norms rather than a verified description of this incident. Readers should treat the exposed data as unspecified beyond the general claim of internal-file theft.

What's at stake

For individuals whose information may have been involved, the practical risks include potential misuse of personal details for phishing, account takeover attempts, or identity-related fraud. Even limited internal documents can contain enough context to make social-engineering messages more convincing. For the organisation, the stakes include regulatory notification duties where applicable, possible contractual obligations to clients and partners, reputational impact, and the operational cost of investigation and remediation. Because the scale and exact data types are undisclosed, the concrete exposure for any single person cannot be quantified from public information alone. The absence of confirmed numbers does not eliminate risk; it simply means affected parties must proceed on the basis of caution rather than precise inventories.

Were you affected?

If you have been a customer, employee, or partner of Una Seguros, consider practical first steps: monitor account statements and credit activity for unusual behaviour, treat unsolicited messages that reference insurance or personal details with heightened scepticism, and enable stronger authentication on important online accounts where available. You may also wish to request information directly from the organisation about whether your data was involved, once official channels are open. As an additional check, readers can run a free exposure scan of their email address to see whether it has already appeared in known breach datasets. Public detail on this incident is limited; remaining alert to official updates from Una Seguros or relevant authorities is the most reliable way to learn of any confirmed impact.

AICompiled with AI assistance from public sources and published under our editorial standards.