play
First seen November 26, 2022Active1,342 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Dancie Perugini Ware Public Relations | June 21, 2023 | ransomware_live | — |
| Peter Mark | June 21, 2023 | ransomware_live | — |
| Shows & Artists | June 2, 2023 | ransomware_live | — |
| NORANET - CZ | June 2, 2023 | ransomware_live | — |
| Abeko | June 2, 2023 | ransomware_live | — |
| Buffalo Niagara Association | June 2, 2023 | ransomware_live | — |
| CS Cargo Group | June 2, 2023 | ransomware_live | — |
| Alberta Newsprint | June 2, 2023 | ransomware_live | — |
| Unico Data,INSYS Industriesysteme,PathA Suisse,PB Swiss Tools,Boess Gruppe | June 2, 2023 | ransomware_live | — |
| Fortress Paper | June 2, 2023 | ransomware_live | — |
| Globalcaja | June 2, 2023 | ransomware_live | — |
| Soroc | May 29, 2023 | ransomware_live | — |
| Paragon Software Lanka | May 23, 2023 | ransomware_live | — |
| Black Cat Networks | May 23, 2023 | ransomware_live | — |
| Aria Online | May 22, 2023 | ransomware_live | — |
| Optimus Steel | May 22, 2023 | ransomware_live | — |
| Studioline Photography | May 22, 2023 | ransomware_live | — |
| Grupo Corporacion Control | May 22, 2023 | ransomware_live | — |
| Mayberry Investments | May 22, 2023 | ransomware_live | — |
| Poly | May 22, 2023 | ransomware_live | — |
| Royal Centre | May 22, 2023 | ransomware_live | — |
| BMD Systemhaus | May 22, 2023 | ransomware_live | — |
| SOWITEC | May 16, 2023 | ransomware_live | — |
| Germany | May 10, 2023 | ransomware_live | — |
| JP Maguire & Associates | May 10, 2023 | ransomware_live | — |
| Sauerbruch Hutton | May 10, 2023 | ransomware_live | — |
| Xplain | May 10, 2023 | ransomware_live | — |
| KLC Network Services | May 9, 2023 | ransomware_live | — |
| Woonkracht10 | May 3, 2023 | ransomware_live | — |
| Vocalcom | May 3, 2023 | ransomware_live | — |
| Negma Business Solutions | May 3, 2023 | ransomware_live | — |
| Commune de Saxon | May 3, 2023 | ransomware_live | — |
| Libra Virtua | May 3, 2023 | ransomware_live | — |
| DGC | May 3, 2023 | ransomware_live | — |
| City of Lowell | May 3, 2023 | ransomware_live | — |
| Nova Group | May 3, 2023 | ransomware_live | — |
| SIVSA | May 3, 2023 | ransomware_live | — |
| Coremain | May 3, 2023 | ransomware_live | — |
| UECC | April 22, 2023 | ransomware_live | — |
| Groupe Gambetta | April 22, 2023 | ransomware_live | — |
| Structab AB (MegTax) | April 18, 2023 | ransomware_live | — |
| Corrib Oil | April 18, 2023 | ransomware_live | — |
| Coldiretti | April 18, 2023 | ransomware_live | — |
| Huissiers | April 18, 2023 | ransomware_live | — |
| Bang IT Solutions | April 18, 2023 | ransomware_live | — |
| CH Media | April 12, 2023 | ransomware_live | — |
| PESA Bydgoszcz | April 11, 2023 | ransomware_live | — |
| Schirm | April 9, 2023 | ransomware_live | — |
| Vleeswarenfabriek Jac Michiels | April 9, 2023 | ransomware_live | — |
| Legion Aero | April 9, 2023 | ransomware_live | — |
| PKF Antares | April 9, 2023 | ransomware_live | — |
| Palo Alto County Sheriff | April 1, 2023 | ransomware_live | — |
| Jablite | March 28, 2023 | ransomware_live | — |
| Oscar Software | March 28, 2023 | ransomware_live | — |
| Pizza 73 | March 26, 2023 | ransomware_live | — |
| Kk Mehta Cpa Associates | March 26, 2023 | ransomware_live | — |
| Picou Builders Supply | March 26, 2023 | ransomware_live | — |
| Guyana Goldfields | March 26, 2023 | ransomware_live | — |
| TAC | March 26, 2023 | ransomware_live | — |
| Lysander Associates | March 26, 2023 | ransomware_live | — |
| James, McElroy and Diehl | March 26, 2023 | ransomware_live | — |
| Optica | March 26, 2023 | ransomware_live | — |
| Lightcast | March 26, 2023 | ransomware_live | — |
| draftPros | March 17, 2023 | ransomware_live | — |
| TaxAssist Accountants | March 17, 2023 | ransomware_live | — |
| Norman Shutters | March 17, 2023 | ransomware_live | — |
| Pine Tree Commercial Realty | March 17, 2023 | ransomware_live | — |
| Berga Recycling | March 17, 2023 | ransomware_live | — |
| A&T group of companies | March 17, 2023 | ransomware_live | — |
| Stanley Steemer | March 17, 2023 | ransomware_live | — |
| Royal Dirkzwager | March 13, 2023 | ransomware_live | — |
| Russell Finex | March 11, 2023 | ransomware_live | — |
| Secure Wrap | March 11, 2023 | ransomware_live | — |
| The M. K. Morse | March 11, 2023 | ransomware_live | — |
| Leemock | March 11, 2023 | ransomware_live | — |
| Real Pro | March 11, 2023 | ransomware_live | — |
| GDZ Computer Services | March 7, 2023 | ransomware_live | — |
| Oakland | March 3, 2023 | ransomware_live | — |
| BMW France | March 3, 2023 | ransomware_live | — |
| O???a?? | March 2, 2023 | ransomware_live | — |
| InPro electric | February 24, 2023 | ransomware_live | — |
| I???o e???t??? | February 21, 2023 | ransomware_live | — |
| Energie Pool Schweiz | February 14, 2023 | ransomware_live | — |
| Microgame SpA | February 14, 2023 | ransomware_live | — |
| A10 | February 9, 2023 | ransomware_live | — |
| M???????? S?? | February 9, 2023 | ransomware_live | — |
| ACS | February 8, 2023 | ransomware_live | — |
| Cave Beblenheim | February 8, 2023 | ransomware_live | — |
| ?C? | February 6, 2023 | ransomware_live | — |
| L?? C??e | February 6, 2023 | ransomware_live | — |
| Point Dedicated Services | February 3, 2023 | ransomware_live | — |
| Helicar | January 27, 2023 | ransomware_live | — |
| ADMIRAL Sportwetten | January 26, 2023 | ransomware_live | — |
| Yorke & Curtis | January 26, 2023 | ransomware_live | — |
| A?????L S?????????? ???? | January 23, 2023 | ransomware_live | — |
| Arnold Clark | January 16, 2023 | ransomware_live | — |
| DAYTON PROGRESS | January 15, 2023 | ransomware_live | — |
| A????? ????k | January 11, 2023 | ransomware_live | — |
| D???? P??????s | January 11, 2023 | ransomware_live | — |
| Furetank | January 3, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).