play
First seen November 26, 2022Active1,308 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| City of Lowell | May 3, 2023 | ransomware_live | — |
| Nova Group | May 3, 2023 | ransomware_live | — |
| SIVSA | May 3, 2023 | ransomware_live | — |
| Coremain | May 3, 2023 | ransomware_live | — |
| UECC | April 22, 2023 | ransomware_live | — |
| Groupe Gambetta | April 22, 2023 | ransomware_live | — |
| Structab AB (MegTax) | April 18, 2023 | ransomware_live | — |
| Corrib Oil | April 18, 2023 | ransomware_live | — |
| Coldiretti | April 18, 2023 | ransomware_live | — |
| Huissiers | April 18, 2023 | ransomware_live | — |
| Bang IT Solutions | April 18, 2023 | ransomware_live | — |
| CH Media | April 12, 2023 | ransomware_live | — |
| PESA Bydgoszcz | April 11, 2023 | ransomware_live | — |
| Schirm | April 9, 2023 | ransomware_live | — |
| Vleeswarenfabriek Jac Michiels | April 9, 2023 | ransomware_live | — |
| Legion Aero | April 9, 2023 | ransomware_live | — |
| PKF Antares | April 9, 2023 | ransomware_live | — |
| Palo Alto County Sheriff | April 1, 2023 | ransomware_live | — |
| Jablite | March 28, 2023 | ransomware_live | — |
| Oscar Software | March 28, 2023 | ransomware_live | — |
| Pizza 73 | March 26, 2023 | ransomware_live | — |
| Kk Mehta Cpa Associates | March 26, 2023 | ransomware_live | — |
| Picou Builders Supply | March 26, 2023 | ransomware_live | — |
| Guyana Goldfields | March 26, 2023 | ransomware_live | — |
| TAC | March 26, 2023 | ransomware_live | — |
| Lysander Associates | March 26, 2023 | ransomware_live | — |
| James, McElroy and Diehl | March 26, 2023 | ransomware_live | — |
| Optica | March 26, 2023 | ransomware_live | — |
| Lightcast | March 26, 2023 | ransomware_live | — |
| draftPros | March 17, 2023 | ransomware_live | — |
| TaxAssist Accountants | March 17, 2023 | ransomware_live | — |
| Norman Shutters | March 17, 2023 | ransomware_live | — |
| Pine Tree Commercial Realty | March 17, 2023 | ransomware_live | — |
| Berga Recycling | March 17, 2023 | ransomware_live | — |
| A&T group of companies | March 17, 2023 | ransomware_live | — |
| Stanley Steemer | March 17, 2023 | ransomware_live | — |
| Royal Dirkzwager | March 13, 2023 | ransomware_live | — |
| Russell Finex | March 11, 2023 | ransomware_live | — |
| Secure Wrap | March 11, 2023 | ransomware_live | — |
| The M. K. Morse | March 11, 2023 | ransomware_live | — |
| Leemock | March 11, 2023 | ransomware_live | — |
| Real Pro | March 11, 2023 | ransomware_live | — |
| GDZ Computer Services | March 7, 2023 | ransomware_live | — |
| Oakland | March 3, 2023 | ransomware_live | — |
| BMW France | March 3, 2023 | ransomware_live | — |
| O???a?? | March 2, 2023 | ransomware_live | — |
| InPro electric | February 24, 2023 | ransomware_live | — |
| I???o e???t??? | February 21, 2023 | ransomware_live | — |
| Energie Pool Schweiz | February 14, 2023 | ransomware_live | — |
| Microgame SpA | February 14, 2023 | ransomware_live | — |
| A10 | February 9, 2023 | ransomware_live | — |
| M???????? S?? | February 9, 2023 | ransomware_live | — |
| ACS | February 8, 2023 | ransomware_live | — |
| Cave Beblenheim | February 8, 2023 | ransomware_live | — |
| ?C? | February 6, 2023 | ransomware_live | — |
| L?? C??e | February 6, 2023 | ransomware_live | — |
| Point Dedicated Services | February 3, 2023 | ransomware_live | — |
| Helicar | January 27, 2023 | ransomware_live | — |
| ADMIRAL Sportwetten | January 26, 2023 | ransomware_live | — |
| Yorke & Curtis | January 26, 2023 | ransomware_live | — |
| A?????L S?????????? ???? | January 23, 2023 | ransomware_live | — |
| Arnold Clark | January 16, 2023 | ransomware_live | — |
| DAYTON PROGRESS | January 15, 2023 | ransomware_live | — |
| A????? ????k | January 11, 2023 | ransomware_live | — |
| D???? P??????s | January 11, 2023 | ransomware_live | — |
| Furetank | January 3, 2023 | ransomware_live | — |
| SUNY Polytechnic Institute | January 3, 2023 | ransomware_live | — |
| Sirius Shipping | January 3, 2023 | ransomware_live | — |
| Tarntank Ship Management | January 3, 2023 | ransomware_live | — |
| S??? | January 2, 2023 | ransomware_live | — |
| Stratacache | January 2, 2023 | ransomware_live | — |
| CDER | January 1, 2023 | ransomware_live | — |
| FURETANK,SIRIUS SHIPPING,VAS,DONSONET | December 27, 2022 | ransomware_live | — |
| F???????, ???, D????????, T???????, S????????????? | December 22, 2022 | ransomware_live | — |
| Cervecería Regional | December 22, 2022 | ransomware_live | — |
| S?????????? | December 18, 2022 | ransomware_live | — |
| Creta Farm | December 18, 2022 | ransomware_live | — |
| C???e????? ????????????? | December 18, 2022 | ransomware_live | — |
| H-Hotels | December 18, 2022 | ransomware_live | — |
| OPUS IT Services | December 18, 2022 | ransomware_live | — |
| JMicron | December 16, 2022 | ransomware_live | — |
| Arsat | December 16, 2022 | ransomware_live | — |
| Cetrogar | December 13, 2022 | ransomware_live | — |
| VFS | December 13, 2022 | ransomware_live | — |
| Antwerpen | December 11, 2022 | ransomware_live | — |
| Una Seguros | December 11, 2022 | ransomware_live | — |
| Hilldrup | December 9, 2022 | ransomware_live | — |
| ??????? | December 9, 2022 | ransomware_live | — |
| ???? | December 8, 2022 | ransomware_live | — |
| ????????? ???? ????? | December 7, 2022 | ransomware_live | — |
| UJV Rez | December 7, 2022 | ransomware_live | — |
| Wrota Mazowsza | December 7, 2022 | ransomware_live | — |
| Highwater Ethanol | December 7, 2022 | ransomware_live | — |
| MME Group | December 7, 2022 | ransomware_live | — |
| Skoda Praha | December 7, 2022 | ransomware_live | — |
| CIBTvisas | December 6, 2022 | ransomware_live | — |
| Austria Presse Agentur | December 5, 2022 | ransomware_live | — |
| ??? | November 29, 2022 | ransomware_live | — |
| ???? ????? | November 28, 2022 | ransomware_live | — |
| ??????????? | November 28, 2022 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).