play
First seen November 26, 2022Active1,342 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Pure Options | October 16, 2026 | ransomware_live | — |
| MicroSearch Corporation | October 16, 2026 | ransomware_live | — |
| New Tec Tool Limited | October 16, 2026 | ransomware_live | — |
| WSBI-ESBG | October 16, 2026 | ransomware_live | — |
| The Innovation Group | October 13, 2026 | ransomlook | — |
| Advanced Imaging Solutions | October 13, 2026 | ransomware_live | — |
| Culinary Specialties | October 13, 2026 | ransomware_live | — |
| Saddlers Court MFG | October 13, 2026 | ransomware_live | — |
| DFK Group | October 13, 2026 | ransomware_live | — |
| Silicon Valley Glass | October 4, 2026 | ransomlook | — |
| Bold Spring Nursery | October 4, 2026 | ransomlook | — |
| Orth Automobile | September 30, 2026 | ransomlook | — |
| Airtech Mechanical Services | September 30, 2026 | ransomlook | — |
| Titus | September 30, 2026 | ransomlook | — |
| Ever Ready First Aid | September 28, 2026 | ransomlook | — |
| Starr Whitehouse Landscape Architects | September 28, 2026 | ransomlook | — |
| Hurley | September 21, 2026 | ransomlook | — |
| Metallco | September 21, 2026 | ransomlook | — |
| Barrett Mahony Consulting Engineers | September 18, 2026 | ransomlook | — |
| Inglewood Golf | September 18, 2026 | ransomlook | — |
| Vista Plastic Solutions | September 18, 2026 | ransomlook | — |
| Grunthal Welding & Supplies | September 10, 2026 | ransomlook | — |
| Sys-kool | September 10, 2026 | ransomlook | — |
| GT Distributors | September 9, 2026 | ransomlook | — |
| Red Star Oil | September 9, 2026 | ransomlook | — |
| Meteor Group | August 31, 2026 | ransomlook | — |
| KRC Machine Tool Solutions | August 31, 2026 | ransomlook | — |
| Figgins Family Wine Estates | August 31, 2026 | ransomlook | — |
| MEQ | August 31, 2026 | ransomlook | — |
| Latoplast | August 20, 2026 | ransomware_live | — |
| Be Media | August 20, 2026 | ransomware_live | — |
| Coltrane Systems | August 18, 2026 | ransomware_live | — |
| Woodhaven Association | August 17, 2026 | ransomware_live | — |
| Sam Pack Auto Group | August 17, 2026 | ransomware_live | — |
| Bridgeport Capital Services | August 17, 2026 | ransomware_live | — |
| Marconi Industrial Services | August 9, 2026 | ransomware_live | — |
| Rilpa Enterprises | August 9, 2026 | ransomware_live | — |
| MIE Solutions | August 9, 2026 | ransomware_live | — |
| Platinum Group | August 6, 2026 | ransomware_live | — |
| GCATS Investments | August 6, 2026 | ransomware_live | — |
| Signature Services | August 6, 2026 | ransomware_live | — |
| Preferred Financial Group | August 4, 2026 | ransomware_live | — |
| First Tek | August 4, 2026 | ransomware_live | — |
| Cambridge Management | August 1, 2026 | ransomware_live | — |
| Sigma Plastics Group | August 1, 2026 | ransomware_live | — |
| The Butcher Brothers | July 27, 2026 | ransomware_live | — |
| Restaurant Depot | July 23, 2026 | ransomware_live | — |
| Record Go Alquiler | July 23, 2026 | ransomware_live | — |
| Kreysler & Associates | July 21, 2026 | ransomware_live | — |
| Svensk Direktreklam | July 16, 2026 | ransomware_live | — |
| Andorra Life | July 16, 2026 | ransomware_live | — |
| AG Scholtes | July 16, 2026 | ransomware_live | — |
| Wring Group | July 16, 2026 | ransomware_live | — |
| Boston Electric and Telephone | July 16, 2026 | ransomware_live | — |
| United Infrastructure | July 7, 2026 | ransomware_live | — |
| Kevin Bao Lenguyen | July 7, 2026 | ransomware_live | — |
| Preneed Funeral Programs | July 7, 2026 | ransomware_live | — |
| Silvestri & Associates Insurance | July 4, 2026 | ransomware_live | — |
| Locati Architects | July 4, 2026 | ransomware_live | — |
| Western Construction | June 30, 2026 | ransomware_live | — |
| Kuhnline | June 27, 2026 | ransomware_live | — |
| J&J Gaming | June 27, 2026 | ransomware_live | — |
| Benchmark Industrial Supply | June 26, 2026 | ransomware_live | — |
| eurOptimum | June 17, 2026 | ransomware_live | — |
| Integrated Technologies | June 17, 2026 | ransomware_live | — |
| Greg Crosslin | June 17, 2026 | ransomware_live | — |
| Rainbow Distributors USA | June 10, 2026 | ransomware_live | — |
| Mundt and Associates | June 10, 2026 | ransomware_live | — |
| Urschel Laboratories | June 4, 2026 | ransomware_live | — |
| Dallis Law Firm | June 2, 2026 | ransomware_live | — |
| Corley MFG | May 29, 2026 | ransomware_live | — |
| The Chapel | May 29, 2026 | ransomware_live | — |
| GW Mechanical | May 20, 2026 | ransomware_live | — |
| Hightower Communications | May 20, 2026 | ransomware_live | — |
| Round Hill Country Club | May 19, 2026 | ransomware_live | — |
| MyPillow | May 17, 2026 | ransomware_live | — |
| Legend Networking & Telecom | May 15, 2026 | ransomware_live | — |
| Pearson Ford | May 12, 2026 | ransomware_live | — |
| Digitall Graphics | May 11, 2026 | ransomware_live | — |
| Ashcroft Homes | May 9, 2026 | ransomware_live | — |
| Town Car International | May 4, 2026 | ransomware_live | — |
| EMA Engineering & Consulting | May 2, 2026 | ransomware_live | — |
| IWC Food Service | May 1, 2026 | ransomware_live | — |
| De Waard Transport | May 1, 2026 | ransomware_live | — |
| Accessoires Outillage Ltee | April 30, 2026 | ransomware_live | — |
| K & E Distributing | April 28, 2026 | ransomware_live | — |
| Northern Mechanical Contractors | April 28, 2026 | ransomware_live | — |
| NL Fisher | April 21, 2026 | ransomware_live | — |
| Infoworld Membership Systems | April 20, 2026 | ransomware_live | — |
| Morphosis | April 6, 2026 | ransomware_live | — |
| Crystal Point | April 6, 2026 | ransomware_live | — |
| Dock Pros | March 30, 2026 | ransomware_live | — |
| Block Engineering | March 24, 2026 | ransomware_live | — |
| Roxiticus Golf Club | March 24, 2026 | ransomware_live | — |
| Weber Kracht & Chellew | March 24, 2026 | ransomware_live | — |
| Brokk | March 24, 2026 | ransomware_live | — |
| Specflue | March 23, 2026 | ransomware_live | — |
| Witt UK Group | March 21, 2026 | ransomware_live | — |
| Valley Plating Inc | March 20, 2026 | ransomware_live | — |
| All Real Estate Title Solutions | March 19, 2026 | ransomware_live | — |
Page 1 of 14Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).