play
First seen November 26, 2022Active1,308 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Precisely, Winshuttle | September 5, 2023 | ransomware_live | — |
| Vucke | September 4, 2023 | ransomware_live | — |
| F??????? ?????s | September 1, 2023 | ransomware_live | — |
| Firmdale Hotels | September 1, 2023 | ransomware_live | — |
| Dpc & S | August 31, 2023 | ransomware_live | — |
| A???? F??????????? Ltd | August 22, 2023 | ransomware_live | — |
| Oneonline | August 18, 2023 | ransomware_live | — |
| Legends Limousine | August 18, 2023 | ransomware_live | — |
| Bolton Group | August 18, 2023 | ransomware_live | — |
| Stanford Transportation Inc | August 18, 2023 | ransomware_live | — |
| BTC Power | August 18, 2023 | ransomware_live | — |
| Miami Management | August 18, 2023 | ransomware_live | — |
| DSA Law Pty Ltd | August 18, 2023 | ransomware_live | — |
| ABS Auto Auctions | August 18, 2023 | ransomware_live | — |
| EAI | August 10, 2023 | ransomware_live | — |
| Algorry Zappia & Associates | August 10, 2023 | ransomware_live | — |
| Top Light | August 10, 2023 | ransomware_live | — |
| Aquatlantis | August 1, 2023 | ransomware_live | — |
| ACTIVA Group | August 1, 2023 | ransomware_live | — |
| Professionnel France | August 1, 2023 | ransomware_live | — |
| Coral Resort | August 1, 2023 | ransomware_live | — |
| DAL-TECH Engineering | August 1, 2023 | ransomware_live | — |
| Birch, Horton, Bittner & Cherot | August 1, 2023 | ransomware_live | — |
| Aapd | August 1, 2023 | ransomware_live | — |
| Garage Living | August 1, 2023 | ransomware_live | — |
| The Dispenser USA | August 1, 2023 | ransomware_live | — |
| FERRE BARNIEDO | July 24, 2023 | ransomware_live | — |
| Grupo MH | July 24, 2023 | ransomware_live | — |
| Primoteq | July 24, 2023 | ransomware_live | — |
| Scharco Elektronik | July 24, 2023 | ransomware_live | — |
| John Mulder Heating & Air Conditioning | July 24, 2023 | ransomware_live | — |
| Samson Electric | July 22, 2023 | ransomware_live | — |
| Centennial Management | July 19, 2023 | ransomware_live | — |
| Sea Force IX | July 19, 2023 | ransomware_live | — |
| Woodbine Hospitality | July 19, 2023 | ransomware_live | — |
| ECS Technology Group | July 19, 2023 | ransomware_live | — |
| Fernmoor Homes | July 19, 2023 | ransomware_live | — |
| Kensington Publishing | July 19, 2023 | ransomware_live | — |
| Lawer SpA | July 7, 2023 | ransomware_live | — |
| Indiana Dimension | July 7, 2023 | ransomware_live | — |
| Star Island Resort | July 7, 2023 | ransomware_live | — |
| Lazer Tow | July 7, 2023 | ransomware_live | — |
| Lane Valente Industries | July 7, 2023 | ransomware_live | — |
| Alfagomma, Argus Fluidhandling Ltd | July 7, 2023 | ransomware_live | — |
| Safety Network | July 6, 2023 | ransomware_live | — |
| Capacity LLC | July 6, 2023 | ransomware_live | — |
| Betty Lou's | July 6, 2023 | ransomware_live | — |
| MUJI Europe Holdings Limited | July 6, 2023 | ransomware_live | — |
| Geneva Software | July 6, 2023 | ransomware_live | — |
| Uniquify | July 6, 2023 | ransomware_live | — |
| NST Attorneys at Law | July 6, 2023 | ransomware_live | — |
| Cambridge Group of Clubs | June 28, 2023 | ransomware_live | — |
| Algotech | June 28, 2023 | ransomware_live | — |
| Intoximeters | June 28, 2023 | ransomware_live | — |
| Texas Heat Treating | June 28, 2023 | ransomware_live | — |
| Hill International | June 22, 2023 | ransomware_live | — |
| wolfs block management limited | June 21, 2023 | ransomware_live | — |
| Lorclon | June 21, 2023 | ransomware_live | — |
| Allpro Consulting Group | June 21, 2023 | ransomware_live | — |
| Luís Simoes | June 21, 2023 | ransomware_live | — |
| Federation Francaise de Rugby | June 21, 2023 | ransomware_live | — |
| PWI Engineering | June 21, 2023 | ransomware_live | — |
| Barentz North America | June 21, 2023 | ransomware_live | — |
| Hi-tec, Batra Group | June 21, 2023 | ransomware_live | — |
| OMNIPOL | June 21, 2023 | ransomware_live | — |
| Summit Hut | June 21, 2023 | ransomware_live | — |
| Dancie Perugini Ware Public Relations | June 21, 2023 | ransomware_live | — |
| Peter Mark | June 21, 2023 | ransomware_live | — |
| Shows & Artists | June 2, 2023 | ransomware_live | — |
| NORANET - CZ | June 2, 2023 | ransomware_live | — |
| Abeko | June 2, 2023 | ransomware_live | — |
| Buffalo Niagara Association | June 2, 2023 | ransomware_live | — |
| CS Cargo Group | June 2, 2023 | ransomware_live | — |
| Alberta Newsprint | June 2, 2023 | ransomware_live | — |
| Unico Data,INSYS Industriesysteme,PathA Suisse,PB Swiss Tools,Boess Gruppe | June 2, 2023 | ransomware_live | — |
| Fortress Paper | June 2, 2023 | ransomware_live | — |
| Globalcaja | June 2, 2023 | ransomware_live | — |
| Soroc | May 29, 2023 | ransomware_live | — |
| Paragon Software Lanka | May 23, 2023 | ransomware_live | — |
| Black Cat Networks | May 23, 2023 | ransomware_live | — |
| Aria Online | May 22, 2023 | ransomware_live | — |
| Optimus Steel | May 22, 2023 | ransomware_live | — |
| Studioline Photography | May 22, 2023 | ransomware_live | — |
| Grupo Corporacion Control | May 22, 2023 | ransomware_live | — |
| Mayberry Investments | May 22, 2023 | ransomware_live | — |
| Poly | May 22, 2023 | ransomware_live | — |
| Royal Centre | May 22, 2023 | ransomware_live | — |
| BMD Systemhaus | May 22, 2023 | ransomware_live | — |
| SOWITEC | May 16, 2023 | ransomware_live | — |
| Germany | May 10, 2023 | ransomware_live | — |
| JP Maguire & Associates | May 10, 2023 | ransomware_live | — |
| Sauerbruch Hutton | May 10, 2023 | ransomware_live | — |
| Xplain | May 10, 2023 | ransomware_live | — |
| KLC Network Services | May 9, 2023 | ransomware_live | — |
| Woonkracht10 | May 3, 2023 | ransomware_live | — |
| Vocalcom | May 3, 2023 | ransomware_live | — |
| Negma Business Solutions | May 3, 2023 | ransomware_live | — |
| Commune de Saxon | May 3, 2023 | ransomware_live | — |
| Libra Virtua | May 3, 2023 | ransomware_live | — |
| DGC | May 3, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).