TPIS Industrial Services Hit by PLAY Ransomware Attack, Exposing Sensitive Data of Over 2,000 Texas Residents
TPIS Industrial Services Inc., a family-owned industrial contractor based in Pasadena, Texas, disclosed a data breach stemming from a ransomware attack that exposed sensitive personal and health information. The incident was reported to the Texas Attorney General on July 17, 2026, with 2,123 Texas residents confirmed as affected.
The breach originated from the PLAY ransomware group, which claimed responsibility on March 26, 2026, via a dark web post. The threat actors asserted they had exfiltrated a broad range of data, including client documents, budget records, payroll information, IDs, tax records, and financial data. The compromised information also included personally identifiable information (PII) such as names, addresses, Social Security numbers, and driver’s license numbers as well as protected health information (PHI), like medical records and health insurance details.
PLAY threatened to publish the stolen data within three days of their initial claim. In response, TPIS Industrial Services began notifying affected individuals, advising them to review breach notification letters for specifics on exposed data and any protective measures offered by the company. The letters also provided contact details for further inquiries.
Source: https://www.claimdepot.com/data-breach/tpis-industrial-services-2026
TPIS Industrial Services, LLC cybersecurity rating report: https://www.rankiteo.com/company/tpis-industrial-services-llc
"id": "TPI1784752766",
"linkid": "tpis-industrial-services-llc",
"type": "Ransomware",
"date": "3/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '2123',
'industry': 'Industrial Services',
'location': 'Pasadena, Texas',
'name': 'TPIS Industrial Services Inc.',
'type': 'Industrial Contractor'}],
'customer_advisories': 'Breach notification letters with protective measures '
'and contact details',
'data_breach': {'data_exfiltration': 'Yes',
'file_types_exposed': ['Client documents',
'Budget records',
'Payroll information',
'IDs',
'Tax records',
'Financial data',
'Medical records',
'Health insurance details'],
'number_of_records_exposed': '2123',
'personally_identifiable_information': ['Names',
'Addresses',
'Social Security '
'numbers',
'Driver’s license '
'numbers'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)',
'Protected Health Information '
'(PHI)']},
'date_publicly_disclosed': '2026-07-17',
'description': 'TPIS Industrial Services Inc., a family-owned industrial '
'contractor based in Pasadena, Texas, disclosed a data breach '
'stemming from a ransomware attack that exposed sensitive '
'personal and health information. The PLAY ransomware group '
'claimed responsibility and threatened to publish the stolen '
'data, which included personally identifiable information '
'(PII) and protected health information (PHI).',
'impact': {'data_compromised': 'Sensitive personal and health information, '
'including PII and PHI',
'identity_theft_risk': 'High'},
'motivation': 'Extortion',
'ransomware': {'data_exfiltration': 'Yes', 'ransomware_strain': 'PLAY'},
'references': [{'source': 'Texas Attorney General'},
{'source': 'PLAY ransomware group dark web post'}],
'regulatory_compliance': {'regulatory_notifications': ['Texas Attorney '
'General']},
'response': {'communication_strategy': 'Breach notification letters sent to '
'affected individuals'},
'threat_actor': 'PLAY ransomware group',
'title': 'TPIS Industrial Services Hit by PLAY Ransomware Attack, Exposing '
'Sensitive Data of Over 2,000 Texas Residents',
'type': 'Ransomware'}