play
First seen November 26, 2022Active1,308 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Meteor Group | August 31, 2026 | ransomlook | — |
| KRC Machine Tool Solutions | August 31, 2026 | ransomlook | — |
| Figgins Family Wine Estates | August 31, 2026 | ransomlook | — |
| MEQ | August 31, 2026 | ransomlook | — |
| Latoplast | August 20, 2026 | ransomware_live | — |
| Be Media | August 20, 2026 | ransomware_live | — |
| Coltrane Systems | August 18, 2026 | ransomware_live | — |
| Woodhaven Association | August 17, 2026 | ransomware_live | — |
| Sam Pack Auto Group | August 17, 2026 | ransomware_live | — |
| Bridgeport Capital Services | August 17, 2026 | ransomware_live | — |
| Marconi Industrial Services | August 9, 2026 | ransomware_live | — |
| Rilpa Enterprises | August 9, 2026 | ransomware_live | — |
| MIE Solutions | August 9, 2026 | ransomware_live | — |
| Platinum Group | August 6, 2026 | ransomware_live | — |
| GCATS Investments | August 6, 2026 | ransomware_live | — |
| Signature Services | August 6, 2026 | ransomware_live | — |
| Preferred Financial Group | August 4, 2026 | ransomware_live | — |
| First Tek | August 4, 2026 | ransomware_live | — |
| Cambridge Management | August 1, 2026 | ransomware_live | — |
| Sigma Plastics Group | August 1, 2026 | ransomware_live | — |
| The Butcher Brothers | July 27, 2026 | ransomware_live | — |
| Restaurant Depot | July 23, 2026 | ransomware_live | — |
| Record Go Alquiler | July 23, 2026 | ransomware_live | — |
| Kreysler & Associates | July 21, 2026 | ransomware_live | — |
| Svensk Direktreklam | July 16, 2026 | ransomware_live | — |
| Andorra Life | July 16, 2026 | ransomware_live | — |
| AG Scholtes | July 16, 2026 | ransomware_live | — |
| Wring Group | July 16, 2026 | ransomware_live | — |
| Boston Electric and Telephone | July 16, 2026 | ransomware_live | — |
| United Infrastructure | July 7, 2026 | ransomware_live | — |
| Kevin Bao Lenguyen | July 7, 2026 | ransomware_live | — |
| Preneed Funeral Programs | July 7, 2026 | ransomware_live | — |
| Silvestri & Associates Insurance | July 4, 2026 | ransomware_live | — |
| Locati Architects | July 4, 2026 | ransomware_live | — |
| Western Construction | June 30, 2026 | ransomware_live | — |
| Kuhnline | June 27, 2026 | ransomware_live | — |
| J&J Gaming | June 27, 2026 | ransomware_live | — |
| Benchmark Industrial Supply | June 26, 2026 | ransomware_live | — |
| eurOptimum | June 17, 2026 | ransomware_live | — |
| Integrated Technologies | June 17, 2026 | ransomware_live | — |
| Greg Crosslin | June 17, 2026 | ransomware_live | — |
| Rainbow Distributors USA | June 10, 2026 | ransomware_live | — |
| Mundt and Associates | June 10, 2026 | ransomware_live | — |
| Urschel Laboratories | June 4, 2026 | ransomware_live | — |
| Dallis Law Firm | June 2, 2026 | ransomware_live | — |
| Corley MFG | May 29, 2026 | ransomware_live | — |
| The Chapel | May 29, 2026 | ransomware_live | — |
| GW Mechanical | May 20, 2026 | ransomware_live | — |
| Hightower Communications | May 20, 2026 | ransomware_live | — |
| Round Hill Country Club | May 19, 2026 | ransomware_live | — |
| MyPillow | May 17, 2026 | ransomware_live | — |
| Legend Networking & Telecom | May 15, 2026 | ransomware_live | — |
| Pearson Ford | May 12, 2026 | ransomware_live | — |
| Digitall Graphics | May 11, 2026 | ransomware_live | — |
| Ashcroft Homes | May 9, 2026 | ransomware_live | — |
| Town Car International | May 4, 2026 | ransomware_live | — |
| EMA Engineering & Consulting | May 2, 2026 | ransomware_live | — |
| IWC Food Service | May 1, 2026 | ransomware_live | — |
| De Waard Transport | May 1, 2026 | ransomware_live | — |
| Accessoires Outillage Ltee | April 30, 2026 | ransomware_live | — |
| K & E Distributing | April 28, 2026 | ransomware_live | — |
| Northern Mechanical Contractors | April 28, 2026 | ransomware_live | — |
| NL Fisher | April 21, 2026 | ransomware_live | — |
| Infoworld Membership Systems | April 20, 2026 | ransomware_live | — |
| Morphosis | April 6, 2026 | ransomware_live | — |
| Crystal Point | April 6, 2026 | ransomware_live | — |
| Dock Pros | March 30, 2026 | ransomware_live | — |
| Block Engineering | March 24, 2026 | ransomware_live | — |
| Roxiticus Golf Club | March 24, 2026 | ransomware_live | — |
| Weber Kracht & Chellew | March 24, 2026 | ransomware_live | — |
| Brokk | March 24, 2026 | ransomware_live | — |
| Specflue | March 23, 2026 | ransomware_live | — |
| Witt UK Group | March 21, 2026 | ransomware_live | — |
| Valley Plating Inc | March 20, 2026 | ransomware_live | — |
| All Real Estate Title Solutions | March 19, 2026 | ransomware_live | — |
| TPIS Industrial Services | March 18, 2026 | ransomware_live | — |
| Window & Door Design Center of Florida | March 16, 2026 | ransomware_live | — |
| Pinnacle | March 16, 2026 | ransomware_live | — |
| Gsolutionz | March 14, 2026 | ransomware_live | — |
| Knight's Site Services | March 13, 2026 | ransomware_live | — |
| Ascent Asset Group | March 13, 2026 | ransomware_live | — |
| Eagle Industrial Equipment | March 7, 2026 | ransomware_live | — |
| Facilities USA | March 6, 2026 | ransomware_live | — |
| Circle Floors | March 6, 2026 | ransomware_live | — |
| Sokolin | March 5, 2026 | ransomware_live | — |
| Equine Canada | March 3, 2026 | ransomware_live | — |
| T a Solberg | March 3, 2026 | ransomware_live | — |
| Go Professional Cases | March 2, 2026 | ransomware_live | — |
| Select Tool | March 1, 2026 | ransomware_live | — |
| Design To Print | February 28, 2026 | ransomware_live | — |
| Cabka | February 27, 2026 | ransomware_live | — |
| The Kuker Group | February 26, 2026 | ransomware_live | — |
| Garland Williams & Associates | February 26, 2026 | ransomware_live | — |
| Southern Concrete Construction | February 26, 2026 | ransomware_live | — |
| Byard F Brogan | February 26, 2026 | ransomware_live | — |
| LRA Constructors | February 25, 2026 | ransomware_live | — |
| Don E Bower | February 25, 2026 | ransomware_live | — |
| Favaro Lavezzo Gill Caretti | February 24, 2026 | ransomware_live | — |
| WCC Technologies Group | February 24, 2026 | ransomware_live | — |
| [Redacted] Ticket #2021 | February 22, 2026 | ransomware_live | — |
Page 1 of 14Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).