play
First seen November 26, 2022Active1,342 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| TPIS Industrial Services | March 18, 2026 | ransomware_live | — |
| Window & Door Design Center of Florida | March 16, 2026 | ransomware_live | — |
| Pinnacle | March 16, 2026 | ransomware_live | — |
| Gsolutionz | March 14, 2026 | ransomware_live | — |
| Knight's Site Services | March 13, 2026 | ransomware_live | — |
| Ascent Asset Group | March 13, 2026 | ransomware_live | — |
| Eagle Industrial Equipment | March 7, 2026 | ransomware_live | — |
| Facilities USA | March 6, 2026 | ransomware_live | — |
| Circle Floors | March 6, 2026 | ransomware_live | — |
| Sokolin | March 5, 2026 | ransomware_live | — |
| Equine Canada | March 3, 2026 | ransomware_live | — |
| T a Solberg | March 3, 2026 | ransomware_live | — |
| Go Professional Cases | March 2, 2026 | ransomware_live | — |
| Select Tool | March 1, 2026 | ransomware_live | — |
| Design To Print | February 28, 2026 | ransomware_live | — |
| Cabka | February 27, 2026 | ransomware_live | — |
| The Kuker Group | February 26, 2026 | ransomware_live | — |
| Garland Williams & Associates | February 26, 2026 | ransomware_live | — |
| Southern Concrete Construction | February 26, 2026 | ransomware_live | — |
| Byard F Brogan | February 26, 2026 | ransomware_live | — |
| LRA Constructors | February 25, 2026 | ransomware_live | — |
| Don E Bower | February 25, 2026 | ransomware_live | — |
| Favaro Lavezzo Gill Caretti | February 24, 2026 | ransomware_live | — |
| WCC Technologies Group | February 24, 2026 | ransomware_live | — |
| [Redacted] Ticket #2021 | February 22, 2026 | ransomware_live | — |
| Young & Associates Consulting Engineers | February 22, 2026 | ransomware_live | — |
| Integrity Building | February 20, 2026 | ransomware_live | — |
| BT Services | February 20, 2026 | ransomware_live | — |
| Faulkner+Locke | February 19, 2026 | ransomware_live | — |
| Cobblestone Creek Country Club | February 19, 2026 | ransomware_live | — |
| Hendrick Construction | February 18, 2026 | ransomware_live | — |
| GapVax | February 18, 2026 | ransomware_live | — |
| Atlantic Design Engineers | February 17, 2026 | ransomware_live | — |
| Landmark Rehab Group | February 17, 2026 | ransomware_live | — |
| DFW Aero Mechanix | February 17, 2026 | ransomware_live | — |
| Chemical Computing Group | February 16, 2026 | ransomware_live | — |
| Sika Technology | February 15, 2026 | ransomware_live | — |
| Kirbor Homes | February 14, 2026 | ransomware_live | — |
| Project Consulting Services | February 14, 2026 | ransomware_live | — |
| Paisley Products of Canada | February 13, 2026 | ransomware_live | — |
| Gulfstream Services | February 13, 2026 | ransomware_live | — |
| Helen Kaminski | February 13, 2026 | ransomware_live | — |
| Arizona Lighting Sales | February 12, 2026 | ransomware_live | — |
| Northbridge | February 11, 2026 | ransomware_live | — |
| Indianapolis Car Exchange | February 11, 2026 | ransomware_live | — |
| Auto Auction of New England | February 10, 2026 | ransomware_live | — |
| Oklahoma Auto Exchange | February 10, 2026 | ransomware_live | — |
| Tropic Tool & Mold | February 10, 2026 | ransomware_live | — |
| Makivik | February 9, 2026 | ransomware_live | — |
| Catalanatto & Barnes | February 8, 2026 | ransomware_live | — |
| Altak | February 8, 2026 | ransomware_live | — |
| ESS Metron | February 7, 2026 | ransomware_live | — |
| UCG Associates | February 7, 2026 | ransomware_live | — |
| HMA | February 6, 2026 | ransomware_live | — |
| Unified Engineering | February 6, 2026 | ransomware_live | — |
| Heartland Title Services | February 6, 2026 | ransomware_live | — |
| Infinity Systems | February 6, 2026 | ransomware_live | — |
| Branagh | February 5, 2026 | ransomware_live | — |
| ISTS | February 4, 2026 | ransomware_live | — |
| Barnes Solicitors LLP | February 4, 2026 | ransomware_live | — |
| Ilderton Contracting | February 2, 2026 | ransomware_live | — |
| Transaction Packing | January 31, 2026 | ransomware_live | — |
| De Gruyter Brill | January 31, 2026 | ransomware_live | — |
| RAL Companies | January 30, 2026 | ransomware_live | — |
| Bloom's Bus Lines | January 30, 2026 | ransomware_live | — |
| Lusamerica Foods | January 30, 2026 | ransomware_live | — |
| KaiserAir | January 28, 2026 | ransomware_live | — |
| Tele Plus | January 26, 2026 | ransomware_live | — |
| Deatak | January 26, 2026 | ransomware_live | — |
| Bar S Services | January 25, 2026 | ransomware_live | — |
| F&B Mfg | January 23, 2026 | ransomware_live | — |
| NAI Plotkin | January 23, 2026 | ransomware_live | — |
| CBH Homes | January 23, 2026 | ransomware_live | — |
| Spring Brook Country Club | January 23, 2026 | ransomware_live | — |
| Quantum Fuel Systems Technologies | January 22, 2026 | ransomware_live | — |
| Woodfield | January 21, 2026 | ransomware_live | — |
| Christine London | January 20, 2026 | ransomware_live | — |
| Milwaukee Forge | January 20, 2026 | ransomware_live | — |
| Aquatic Control | January 19, 2026 | ransomware_live | — |
| Joyva | January 18, 2026 | ransomware_live | — |
| California Tax Data | January 17, 2026 | ransomware_live | — |
| TREC Group | January 15, 2026 | ransomware_live | — |
| Encore Roofing | January 14, 2026 | ransomware_live | — |
| Midway Windows and Doors | January 13, 2026 | ransomware_live | — |
| Eastern Ice | January 12, 2026 | ransomware_live | — |
| Riverwood Golf Club | January 12, 2026 | ransomware_live | — |
| Ampex Data Systems | January 12, 2026 | ransomware_live | — |
| CE Electronics | January 9, 2026 | ransomware_live | — |
| Routten & Laster Law | January 6, 2026 | ransomware_live | — |
| Raymundos Food Group | January 4, 2026 | ransomware_live | — |
| Garner Foods | January 2, 2026 | ransomware_live | — |
| C&r Electric | December 29, 2025 | ransomware_live | — |
| Genoa Lakes | December 29, 2025 | ransomware_live | — |
| Lakeside Title Company | December 29, 2025 | ransomware_live | — |
| WiZiX Technology Group | December 28, 2025 | ransomware_live | — |
| MP Filtri | December 26, 2025 | ransomware_live | — |
| JZ Russell Industries | December 26, 2025 | ransomware_live | — |
| Stoughton Steel | December 26, 2025 | ransomware_live | — |
| Rockport Technology Group | December 26, 2025 | ransomware_live | — |
| Pewarchuk CPA | December 26, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).