play
First seen November 26, 2022Active1,342 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| HD Media Systems | March 6, 2024 | ransomware_live | — |
| Crestone Group | March 6, 2024 | ransomware_live | — |
| Takeuchi US | March 6, 2024 | ransomware_live | — |
| Waterborne Environmental | March 6, 2024 | ransomware_live | — |
| Koch & White Heating & Cooling | March 6, 2024 | ransomware_live | — |
| Jean-Georges | March 6, 2024 | ransomware_live | — |
| ADC Aerospace | March 6, 2024 | ransomware_live | — |
| Infinite Computing Systems | March 6, 2024 | ransomware_live | — |
| Autohaus Pichel GmbH | March 6, 2024 | ransomware_live | — |
| Cemtech | March 6, 2024 | ransomware_live | — |
| Serrano Industries | March 6, 2024 | ransomware_live | — |
| Executive Aviation | March 6, 2024 | ransomware_live | — |
| Capital Wholesale Drug | March 6, 2024 | ransomware_live | — |
| Lucky Look | March 6, 2024 | ransomware_live | — |
| Colorado Construction | March 6, 2024 | ransomware_live | — |
| DURAND-WAYLAND | March 6, 2024 | ransomware_live | — |
| ACC Construction | March 6, 2024 | ransomware_live | — |
| Zuther Hautmann | March 6, 2024 | ransomware_live | — |
| Tax MT | March 6, 2024 | ransomware_live | — |
| The DeBruler | March 6, 2024 | ransomware_live | — |
| Lambda Energy Resources | March 5, 2024 | ransomware_live | — |
| Quality Enclosures | March 5, 2024 | ransomware_live | — |
| Pavilion Construction | March 4, 2024 | ransomware_live | — |
| New Bedford Welding Supply | March 1, 2024 | ransomware_live | — |
| Stack Infrastructure | March 1, 2024 | ransomware_live | — |
| Bechtold | March 1, 2024 | ransomware_live | — |
| BiTec | February 29, 2024 | ransomware_live | — |
| Schokinag | February 27, 2024 | ransomware_live | — |
| Bridger Insurance | February 26, 2024 | ransomware_live | — |
| W???h? | February 22, 2024 | ransomware_live | — |
| Grassmid Transport | February 22, 2024 | ransomware_live | — |
| SREE Hotels | February 21, 2024 | ransomware_live | — |
| Image Pointe | February 21, 2024 | ransomware_live | — |
| QEO Group | February 21, 2024 | ransomware_live | — |
| American Nuts | February 20, 2024 | ransomware_live | — |
| Premier Technology | February 20, 2024 | ransomware_live | — |
| Lawrence Semiconductor Research Laboratory | February 20, 2024 | ransomware_live | — |
| Fashion UK | February 19, 2024 | ransomware_live | — |
| Coastal Car | February 18, 2024 | ransomware_live | — |
| Winona Pattern & Mold | February 16, 2024 | ransomware_live | — |
| Compact Mould | February 16, 2024 | ransomware_live | — |
| Trans+Plus Systems | February 16, 2024 | ransomware_live | — |
| SilverLining | February 15, 2024 | ransomware_live | — |
| DuBose Strapping | February 15, 2024 | ransomware_live | — |
| Kool-air | February 15, 2024 | ransomware_live | — |
| Influence Communication | February 15, 2024 | ransomware_live | — |
| Marketon | February 15, 2024 | ransomware_live | — |
| FBi Construction | February 14, 2024 | ransomware_live | — |
| A&A Wireless | February 14, 2024 | ransomware_live | — |
| QI Group | February 13, 2024 | ransomware_live | — |
| Skyland Grain | February 12, 2024 | ransomware_live | — |
| Continental Aerospace Technologies | February 12, 2024 | ransomware_live | — |
| von Hagen | February 11, 2024 | ransomware_live | — |
| Norman, Fox | February 10, 2024 | ransomware_live | — |
| LD Davis | February 9, 2024 | ransomware_live | — |
| Gilmore & Associates | February 8, 2024 | ransomware_live | — |
| HR Ewell & Hy-tec | February 7, 2024 | ransomware_live | — |
| Powill Manufacturing & Engineering | February 7, 2024 | ransomware_live | — |
| Hedlunds | February 5, 2024 | ransomware_live | — |
| Innovex Downhole Solutions | February 2, 2024 | ransomware_live | — |
| Welch's | February 1, 2024 | ransomware_live | — |
| Onclusive | January 30, 2024 | ransomware_live | — |
| Modern Kitchens | January 26, 2024 | ransomware_live | — |
| Ready Mixed Concrete | January 25, 2024 | ransomware_live | — |
| Festspielhaus Baden-Baden | January 25, 2024 | ransomware_live | — |
| Hannon Transport | January 24, 2024 | ransomware_live | — |
| McMillan Pazdan Smith | January 23, 2024 | ransomware_live | — |
| Greenwich Leisure | January 22, 2024 | ransomware_live | — |
| MeerServices | January 22, 2024 | ransomware_live | — |
| Mason Construction | January 19, 2024 | ransomware_live | — |
| Mechanical Reps | January 19, 2024 | ransomware_live | — |
| Albert Bartlett | January 18, 2024 | ransomware_live | — |
| Canada Revenue Agency | January 18, 2024 | ransomware_live | — |
| Alber Law Group | January 16, 2024 | ransomware_live | — |
| Virgin Islands Lottery | January 12, 2024 | ransomware_live | — |
| Leaders Staffing | January 10, 2024 | ransomware_live | — |
| Premier Facility Management | January 9, 2024 | ransomware_live | — |
| Fareri Associates | January 5, 2024 | ransomware_live | — |
| Douglas County Libraries | January 3, 2024 | ransomware_live | — |
| Perry-McCall Construction | January 2, 2024 | ransomware_live | — |
| Keyser Mason Ball | December 30, 2023 | ransomware_live | — |
| Morgan, Chambers & Wright & The Green Group | December 30, 2023 | ransomware_live | — |
| CVR Associates | December 28, 2023 | ransomware_live | — |
| Owen Quilty Professional | December 21, 2023 | ransomware_live | — |
| Televerde | December 21, 2023 | ransomware_live | — |
| Packaging Solutions | December 20, 2023 | ransomware_live | — |
| Concept Data | December 20, 2023 | ransomware_live | — |
| Jon Richard | December 20, 2023 | ransomware_live | — |
| Madison Capital & WPM & The Time Group | December 20, 2023 | ransomware_live | — |
| The CM Paula | December 18, 2023 | ransomware_live | — |
| C?????z???? | December 18, 2023 | ransomware_live | — |
| Succes Schoonmaak | December 18, 2023 | ransomware_live | — |
| Waldner's | December 18, 2023 | ransomware_live | — |
| Schoepe Display | December 18, 2023 | ransomware_live | — |
| GlobalSpec | December 12, 2023 | ransomware_live | — |
| Kuriyama of America | December 7, 2023 | ransomware_live | — |
| AG Consulting Engineering | December 7, 2023 | ransomware_live | — |
| Planbox | December 7, 2023 | ransomware_live | — |
| GVM | December 7, 2023 | ransomware_live | — |
| Vitro Plus | December 7, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).