Hilldun Data Breach: A Ransomware Group Claimed the Attack

Hilldun Corporation is a New York City-based financial-services company that specializes in accounts receivable financing and factoring services for businesses in the fashion and consumer-products industries. Threat-intelligence firm DeXpose reported that on September 22, 2025, the PLAY ransomware group claimed responsibility for an attack on Hilldun and threatened to leak its data. Hilldun has not named any group, and the claim has not been independently verified.

The breach was reported to multiple state regulators, including the Vermont Attorney General and the Massachusetts Attorney General, both on July 24, 2026. Hilldun’s letter does not give a date for the incident or explain the gap between the September 2025 claim and the July 2026 notices.

The PLAY group threatened to leak data it said it had taken. Massachusetts’ 2026 breach report lists the types of personal information involved as Social Security numbers, financial account information, credit and debit card numbers, and driver’s licenses. The Vermont Attorney General’s breach-notice list categorizes the Hilldun filing as involving Social Security numbers.

When Social Security numbers, financial account details, and payment card numbers are exposed together, affected individuals may face a heightened risk of financial identity theft and fraud. Because a threat actor publicly claimed to have obtained and intended to publish the data, potentially affected individuals should treat the risk of misuse seriously.

Hilldun provides financing and factoring services to businesses, so affected individuals may include people whose information the company maintained in connection with those services, as well as employees whose payroll or tax records were involved. The full number of individuals affected was not publicly stated at the time of writing; the Vermont Attorney General’s list reflects only the count of Vermont residents.

Because the stolen data reportedly included identification documents and financial records, and because the PLAY group signaled an intent to publish it, remaining vigilant is important. Data exposed in ransomware and extortion incidents can circulate for a long time, so monitoring your accounts over an extended period is prudent.

Keep your notification letter, as it identifies the specific information involved in your case and any protective services offered. Monitor your financial accounts and credit card statements closely for unauthorized activity, and review your free credit reports at AnnualCreditReport.com for unfamiliar accounts. Given that Social Security numbers were involved, consider placing a fraud alert or a credit freeze with the three major credit bureaus at no cost.

Be cautious of phishing emails, calls, or texts that reference Hilldun or the breach, as scammers sometimes use breach news to craft convincing messages. Beyond these self-protective steps, a legal professional can help you understand whether you may be entitled to compensation and what your rights are.

See our guide to the MBE CPAs data breach lawsuit if you were affected by that incident.