HMP Global Listed by qilin Ransomware Group

On October 14, 2025, healthcare education and events company HMP Global appeared on the leak site of the qilin ransomware group, with internal files exfiltrated during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates the company, which has operated for 40 years, was listed on the qilin leak portal hosted on an onion site. The data consists of internal files taken during the ransomware incident. HMP Global produces well-known professional brands including Psych Congress, a leading mental health education platform, and the Symposium on Advanced Wound Care, described as the largest wound care meeting in the world. No confirmed victim count has been released, and the precise volume or specific categories of exposed records remain unclear from available reporting. The listing appeared on the group’s leak site, a common tactic used to pressure victims into paying to prevent further publication.

Why This Matters for You and Your Family

When a healthcare education provider like HMP Global suffers a breach, the information inside its systems can include details tied to medical professionals, event attendees, vendors, and partner organizations. Internal files often contain names, contact information, professional credentials, and sometimes personal identifiers that connect back to individuals and their households. If your doctor, therapist, or a family member has attended Psych Congress or SAWC events, your data or theirs may now sit in an attacker’s hands. Credential leaks of this nature frequently cascade into account takeovers on personal email, banking, or social media. For families, the exposure of one adult’s professional records can quickly pull in spouses and children through shared addresses, phone numbers, or reused passwords.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at the initial theft. Once internal files leave the victim’s network, the data becomes raw material for doxxing chains. A single email or phone number can be cross-referenced with gaming accounts, social profiles, and public records to build a complete picture of you and your family. Children’s gaming accounts are especially vulnerable because kids often reuse credentials or email addresses tied to a parent’s professional registration. Available reporting describes how these chains allow attackers to move from corporate data to personal harassment, identity theft, or extortion. The speed at which such information spreads across underground forums makes early detection critical.

Qilin’s Publicly Known Track Record

Public reporting attributes the qilin ransomware group with emerging in 2022. The group has targeted organizations across healthcare, education, manufacturing, and technology sectors. Notable prior victims include mid-sized hospitals, software firms, and professional service providers. Their typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by rapid exfiltration of sensitive files before encryption. Qilin then demands payment to prevent publication on their leak site, often setting short deadlines and increasing pressure by releasing sample data. Industry research from sources such as DoxxScan™ continuous monitoring indicates that organizations in healthcare-adjacent fields appear frequently in similar incidents.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the HMP Global breach.
• Rotate any password you used for HMP Global accounts or event registrations anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught within hours instead of months.
• Cover the household with DoxxScan family coverage that includes dependents and children’s gaming accounts, which often form the weakest link in these identity chains.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your own accounts.

The HMP Global incident shows how quickly professional data can become personal risk. One breach at a trusted healthcare education provider can feed months of follow-on attacks against you and your family. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts. Starting now gives you the clearest view of what has already leaked and the fastest path to closing those doors before criminals exploit them.