Hilldun Corp.: Hilldun Data Breach Exposes Social Security Numbers

Hilldun Corp. Data Breach Exposes Social Security Numbers in Cyberattack by PLAY Group

Hilldun Corp., a New York City-based financial services firm specializing in accounts receivable financing and factoring for the fashion and consumer products industries, disclosed a data breach involving the exposure of Social Security numbers. The incident was reported to the Vermont Attorney General on July 24, 2026.

The breach was first publicized on September 22, 2025, when the PLAY ransomware group claimed responsibility on the Tor network. The threat actors asserted they had exfiltrated a wide range of sensitive data, including confidential client documents, budget records, payroll information, accounting files, tax records, identification documents, and financial data. PLAY announced plans to publish the stolen data on September 25, 2025.

While Hilldun confirmed that Social Security numbers were among the exposed information, the full extent of the breach remains under investigation. The company has not disclosed additional details regarding the attack’s scope or the number of affected individuals.

Source: https://www.claimdepot.com/data-breach/hilldun-corporation-2026

Hilldun Corporation cybersecurity rating report: https://www.rankiteo.com/company/hilldun-corporation

"id": "HIL1785170103",
"linkid": "hilldun-corporation",
"type": "Ransomware",
"date": "9/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Accounts Receivable Financing, Factoring',
                        'location': 'New York City, USA',
                        'name': 'Hilldun Corp.',
                        'type': 'Financial Services Firm'}],
 'data_breach': {'data_exfiltration': 'Yes',
                 'personally_identifiable_information': 'Social Security '
                                                        'numbers, '
                                                        'identification '
                                                        'documents',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Social Security numbers, '
                                             'confidential client documents, '
                                             'budget records, payroll '
                                             'information, accounting files, '
                                             'tax records, identification '
                                             'documents, financial data'},
 'date_publicly_disclosed': '2025-09-22',
 'description': 'Hilldun Corp., a New York City-based financial services firm '
                'specializing in accounts receivable financing and factoring '
                'for the fashion and consumer products industries, disclosed a '
                'data breach involving the exposure of Social Security '
                'numbers. The PLAY ransomware group claimed responsibility and '
                'exfiltrated sensitive data, including confidential client '
                'documents, budget records, payroll information, accounting '
                'files, tax records, identification documents, and financial '
                'data.',
 'impact': {'data_compromised': 'Social Security numbers, confidential client '
                                'documents, budget records, payroll '
                                'information, accounting files, tax records, '
                                'identification documents, financial data',
            'identity_theft_risk': 'High'},
 'investigation_status': 'Ongoing',
 'ransomware': {'data_exfiltration': 'Yes', 'ransomware_strain': 'PLAY'},
 'references': [{'source': 'Vermont Attorney General'},
                {'source': 'PLAY ransomware group (Tor network)'}],
 'regulatory_compliance': {'regulatory_notifications': 'Reported to Vermont '
                                                       'Attorney General on '
                                                       '2026-07-24'},
 'threat_actor': 'PLAY ransomware group',
 'title': 'Hilldun Corp. Data Breach Exposes Social Security Numbers in '
          'Cyberattack by PLAY Group',
 'type': 'Data Breach, Ransomware'}