play
First seen November 26, 2022Active1,308 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| McHale Landscape Design | November 22, 2023 | ransomware_live | — |
| Greater Richmond Transit | November 22, 2023 | ransomware_live | — |
| ConSpare | November 14, 2023 | ransomware_live | — |
| Guntert & Zimmerman | November 14, 2023 | ransomware_live | — |
| Wyatt Detention Center | November 14, 2023 | ransomware_live | — |
| KaDeWe | November 14, 2023 | ransomware_live | — |
| Road Scholar Transport | November 14, 2023 | ransomware_live | — |
| Thompson Candy | November 14, 2023 | ransomware_live | — |
| Global Technologies Racing Ltd | November 14, 2023 | ransomware_live | — |
| Nomot | November 14, 2023 | ransomware_live | — |
| Trademark Property | November 14, 2023 | ransomware_live | — |
| Fgs | November 14, 2023 | ransomware_live | — |
| Proforma Albrecht | November 14, 2023 | ransomware_live | — |
| PIKE Technologies | November 14, 2023 | ransomware_live | — |
| The DMC | November 11, 2023 | ransomware_live | — |
| Canderel Management | November 9, 2023 | ransomware_live | — |
| Richard Harris Personal Injury Law Firm | November 9, 2023 | ransomware_live | — |
| Crown Supply Co | November 8, 2023 | ransomware_live | — |
| DESIGNA Verkehrsleittechnik | November 8, 2023 | ransomware_live | — |
| M.R. Williams | November 8, 2023 | ransomware_live | — |
| GeoPoint Surveying | November 3, 2023 | ransomware_live | — |
| Ricardo | November 2, 2023 | ransomware_live | — |
| Gsp Components | November 2, 2023 | ransomware_live | — |
| North Dakota Grain Inspection Services | November 2, 2023 | ransomware_live | — |
| Hilyard's | November 2, 2023 | ransomware_live | — |
| Craft-Maid | November 2, 2023 | ransomware_live | — |
| JDRM Engineering | November 2, 2023 | ransomware_live | — |
| Bry-Air | November 1, 2023 | ransomware_live | — |
| G??P???? S????y??? | October 31, 2023 | ransomware_live | — |
| JS Hovnanian & Sons | October 31, 2023 | ransomware_live | — |
| Het Veer | October 28, 2023 | ransomware_live | — |
| KDI Office Technology | October 28, 2023 | ransomware_live | — |
| Online Development | October 28, 2023 | ransomware_live | — |
| Bush Refrigeration | October 28, 2023 | ransomware_live | — |
| Waterstone Faucets | October 28, 2023 | ransomware_live | — |
| Yingling Aviation | October 28, 2023 | ransomware_live | — |
| Encompass Elements | October 28, 2023 | ransomware_live | — |
| Alpha Mortgage | October 28, 2023 | ransomware_live | — |
| Dallas County | October 28, 2023 | ransomware_live | — |
| Identification Products | October 27, 2023 | ransomware_live | — |
| Conditioned Air | October 26, 2023 | ransomware_live | — |
| Ackerman-Estvold | October 26, 2023 | ransomware_live | — |
| Inclinator | October 25, 2023 | ransomware_live | — |
| M&n Management | October 25, 2023 | ransomware_live | — |
| Meindl | October 24, 2023 | ransomware_live | — |
| Milk Source | October 20, 2023 | ransomware_live | — |
| Venture Plastics | October 20, 2023 | ransomware_live | — |
| The Fountain Group | October 20, 2023 | ransomware_live | — |
| Hygieneering | October 20, 2023 | ransomware_live | — |
| Ipswich Bay Glass | October 20, 2023 | ransomware_live | — |
| Polar Tech Industries | October 20, 2023 | ransomware_live | — |
| RADISE | October 20, 2023 | ransomware_live | — |
| Kobi Karp Architecture and Interior Design | October 20, 2023 | ransomware_live | — |
| Bridgeport Fittings | October 20, 2023 | ransomware_live | — |
| Tru-val Electric | October 20, 2023 | ransomware_live | — |
| Epaccsys | October 20, 2023 | ransomware_live | — |
| Williamson Foodservice | October 20, 2023 | ransomware_live | — |
| Laiho Group | October 20, 2023 | ransomware_live | — |
| Associated Wholesale Grocers | October 19, 2023 | ransomware_live | — |
| The Supply Room Companies & Citron WorkSpaces | October 19, 2023 | ransomware_live | — |
| Sam Tell Companies | October 17, 2023 | ransomware_live | — |
| CK Associates | October 17, 2023 | ransomware_live | — |
| Drug Emporium | October 16, 2023 | ransomware_live | — |
| Brodart | October 13, 2023 | ransomware_live | — |
| Hughes Gill Cochrane Tinetti | October 10, 2023 | ransomware_live | — |
| M??? T?????? | October 9, 2023 | ransomware_live | — |
| Centek industries | October 9, 2023 | ransomware_live | — |
| NachtExpress Austria GmbH | October 9, 2023 | ransomware_live | — |
| WCM Europe | October 9, 2023 | ransomware_live | — |
| Starr Finley | October 9, 2023 | ransomware_live | — |
| Saltire Energy | October 9, 2023 | ransomware_live | — |
| Metro Transit | October 9, 2023 | ransomware_live | — |
| Stavanger Municipality | October 4, 2023 | ransomware_live | — |
| CHARMANT Group | October 4, 2023 | ransomware_live | — |
| Cinepolis USA | October 4, 2023 | ransomware_live | — |
| Filtration Control | October 4, 2023 | ransomware_live | — |
| Security Instrument | October 4, 2023 | ransomware_live | — |
| Roof Management | October 4, 2023 | ransomware_live | — |
| Wexas | September 28, 2023 | ransomware_live | — |
| Plumbase | September 28, 2023 | ransomware_live | — |
| Kessler Collins | September 28, 2023 | ransomware_live | — |
| Terralogic | September 28, 2023 | ransomware_live | — |
| Van Eck Transport | September 28, 2023 | ransomware_live | — |
| BAMO | September 28, 2023 | ransomware_live | — |
| Amanzi Marble & Granite | September 28, 2023 | ransomware_live | — |
| Webb Landscape | September 28, 2023 | ransomware_live | — |
| Robuck Homes | September 28, 2023 | ransomware_live | — |
| Jacobson | September 28, 2023 | ransomware_live | — |
| PASCHAL - Werk G Maier | September 18, 2023 | ransomware_live | — |
| TSC | September 18, 2023 | ransomware_live | — |
| RTA | September 18, 2023 | ransomware_live | — |
| Markentrainer Werbeagentur, Elwema Automotive | September 13, 2023 | ransomware_live | — |
| Carpet One | September 13, 2023 | ransomware_live | — |
| First Line | September 9, 2023 | ransomware_live | — |
| Rea Magnet Wire | September 7, 2023 | ransomware_live | — |
| Majestic Spice | September 5, 2023 | ransomware_live | — |
| Bordelon Marine | September 5, 2023 | ransomware_live | — |
| Master Interiors | September 5, 2023 | ransomware_live | — |
| Markentrainer Werbeagentur | September 5, 2023 | ransomware_live | — |
| Kikkerland Design | September 5, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).