play
First seen November 26, 2022Active1,308 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| American Nuts | February 20, 2024 | ransomware_live | — |
| Premier Technology | February 20, 2024 | ransomware_live | — |
| Lawrence Semiconductor Research Laboratory | February 20, 2024 | ransomware_live | — |
| Fashion UK | February 19, 2024 | ransomware_live | — |
| Coastal Car | February 18, 2024 | ransomware_live | — |
| Winona Pattern & Mold | February 16, 2024 | ransomware_live | — |
| Compact Mould | February 16, 2024 | ransomware_live | — |
| Trans+Plus Systems | February 16, 2024 | ransomware_live | — |
| SilverLining | February 15, 2024 | ransomware_live | — |
| DuBose Strapping | February 15, 2024 | ransomware_live | — |
| Kool-air | February 15, 2024 | ransomware_live | — |
| Influence Communication | February 15, 2024 | ransomware_live | — |
| Marketon | February 15, 2024 | ransomware_live | — |
| FBi Construction | February 14, 2024 | ransomware_live | — |
| A&A Wireless | February 14, 2024 | ransomware_live | — |
| QI Group | February 13, 2024 | ransomware_live | — |
| Skyland Grain | February 12, 2024 | ransomware_live | — |
| Continental Aerospace Technologies | February 12, 2024 | ransomware_live | — |
| von Hagen | February 11, 2024 | ransomware_live | — |
| Norman, Fox | February 10, 2024 | ransomware_live | — |
| LD Davis | February 9, 2024 | ransomware_live | — |
| Gilmore & Associates | February 8, 2024 | ransomware_live | — |
| HR Ewell & Hy-tec | February 7, 2024 | ransomware_live | — |
| Powill Manufacturing & Engineering | February 7, 2024 | ransomware_live | — |
| Hedlunds | February 5, 2024 | ransomware_live | — |
| Innovex Downhole Solutions | February 2, 2024 | ransomware_live | — |
| Welch's | February 1, 2024 | ransomware_live | — |
| Onclusive | January 30, 2024 | ransomware_live | — |
| Modern Kitchens | January 26, 2024 | ransomware_live | — |
| Ready Mixed Concrete | January 25, 2024 | ransomware_live | — |
| Festspielhaus Baden-Baden | January 25, 2024 | ransomware_live | — |
| Hannon Transport | January 24, 2024 | ransomware_live | — |
| McMillan Pazdan Smith | January 23, 2024 | ransomware_live | — |
| Greenwich Leisure | January 22, 2024 | ransomware_live | — |
| MeerServices | January 22, 2024 | ransomware_live | — |
| Mason Construction | January 19, 2024 | ransomware_live | — |
| Mechanical Reps | January 19, 2024 | ransomware_live | — |
| Albert Bartlett | January 18, 2024 | ransomware_live | — |
| Canada Revenue Agency | January 18, 2024 | ransomware_live | — |
| Alber Law Group | January 16, 2024 | ransomware_live | — |
| Virgin Islands Lottery | January 12, 2024 | ransomware_live | — |
| Leaders Staffing | January 10, 2024 | ransomware_live | — |
| Premier Facility Management | January 9, 2024 | ransomware_live | — |
| Fareri Associates | January 5, 2024 | ransomware_live | — |
| Douglas County Libraries | January 3, 2024 | ransomware_live | — |
| Perry-McCall Construction | January 2, 2024 | ransomware_live | — |
| Keyser Mason Ball | December 30, 2023 | ransomware_live | — |
| Morgan, Chambers & Wright & The Green Group | December 30, 2023 | ransomware_live | — |
| CVR Associates | December 28, 2023 | ransomware_live | — |
| Owen Quilty Professional | December 21, 2023 | ransomware_live | — |
| Televerde | December 21, 2023 | ransomware_live | — |
| Packaging Solutions | December 20, 2023 | ransomware_live | — |
| Concept Data | December 20, 2023 | ransomware_live | — |
| Jon Richard | December 20, 2023 | ransomware_live | — |
| Madison Capital & WPM & The Time Group | December 20, 2023 | ransomware_live | — |
| The CM Paula | December 18, 2023 | ransomware_live | — |
| C?????z???? | December 18, 2023 | ransomware_live | — |
| Succes Schoonmaak | December 18, 2023 | ransomware_live | — |
| Waldner's | December 18, 2023 | ransomware_live | — |
| Schoepe Display | December 18, 2023 | ransomware_live | — |
| GlobalSpec | December 12, 2023 | ransomware_live | — |
| Kuriyama of America | December 7, 2023 | ransomware_live | — |
| AG Consulting Engineering | December 7, 2023 | ransomware_live | — |
| Planbox | December 7, 2023 | ransomware_live | — |
| GVM | December 7, 2023 | ransomware_live | — |
| Vitro Plus | December 7, 2023 | ransomware_live | — |
| Payne Hicks Beach | December 7, 2023 | ransomware_live | — |
| Becker Furniture World | December 7, 2023 | ransomware_live | — |
| Capespan | December 7, 2023 | ransomware_live | — |
| Burton Wire & Cable | December 7, 2023 | ransomware_live | — |
| GreenWaste Recovery | December 7, 2023 | ransomware_live | — |
| Silvent North America | December 7, 2023 | ransomware_live | — |
| PHIBRO GMBH | December 7, 2023 | ransomware_live | — |
| AJO | December 7, 2023 | ransomware_live | — |
| Ridge Vineyards | December 7, 2023 | ransomware_live | — |
| PLS Logistics | December 7, 2023 | ransomware_live | — |
| Postworks | December 7, 2023 | ransomware_live | — |
| Intrepid Sea, Air & Space Museum | December 7, 2023 | ransomware_live | — |
| SMRT | December 7, 2023 | ransomware_live | — |
| California Innovations | December 7, 2023 | ransomware_live | — |
| TPG Architecture | December 6, 2023 | ransomware_live | — |
| Red River Title | December 6, 2023 | ransomware_live | — |
| DYWIDAG-Systems & American Transportation | December 5, 2023 | ransomware_live | — |
| Northeastern Sheet Metal | December 5, 2023 | ransomware_live | — |
| SinglePoint Outsourcing | November 28, 2023 | ransomware_live | — |
| Thillens | November 28, 2023 | ransomware_live | — |
| Elston-nationwide | November 28, 2023 | ransomware_live | — |
| AMERICAN INSULATED GLASS | November 28, 2023 | ransomware_live | — |
| MooreCo | November 28, 2023 | ransomware_live | — |
| Continental Shipping Line | November 28, 2023 | ransomware_live | — |
| Sparex | November 28, 2023 | ransomware_live | — |
| Retailer Web Services | November 28, 2023 | ransomware_live | — |
| Byfod | November 28, 2023 | ransomware_live | — |
| SurvTech Solutions | November 28, 2023 | ransomware_live | — |
| EDGE Realty Partners | November 28, 2023 | ransomware_live | — |
| Noble Mountain Tree Farm | November 28, 2023 | ransomware_live | — |
| Unitransfer | November 28, 2023 | ransomware_live | — |
| SC Hydraulic Engineering | November 28, 2023 | ransomware_live | — |
| Labtopia | November 28, 2023 | ransomware_live | — |
| OLA Consulting Engineers | November 28, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).