play
First seen November 26, 2022Active1,308 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Young & Associates Consulting Engineers | February 22, 2026 | ransomware_live | — |
| Integrity Building | February 20, 2026 | ransomware_live | — |
| BT Services | February 20, 2026 | ransomware_live | — |
| Faulkner+Locke | February 19, 2026 | ransomware_live | — |
| Cobblestone Creek Country Club | February 19, 2026 | ransomware_live | — |
| Hendrick Construction | February 18, 2026 | ransomware_live | — |
| GapVax | February 18, 2026 | ransomware_live | — |
| Atlantic Design Engineers | February 17, 2026 | ransomware_live | — |
| Landmark Rehab Group | February 17, 2026 | ransomware_live | — |
| DFW Aero Mechanix | February 17, 2026 | ransomware_live | — |
| Chemical Computing Group | February 16, 2026 | ransomware_live | — |
| Sika Technology | February 15, 2026 | ransomware_live | — |
| Kirbor Homes | February 14, 2026 | ransomware_live | — |
| Project Consulting Services | February 14, 2026 | ransomware_live | — |
| Paisley Products of Canada | February 13, 2026 | ransomware_live | — |
| Gulfstream Services | February 13, 2026 | ransomware_live | — |
| Helen Kaminski | February 13, 2026 | ransomware_live | — |
| Arizona Lighting Sales | February 12, 2026 | ransomware_live | — |
| Northbridge | February 11, 2026 | ransomware_live | — |
| Indianapolis Car Exchange | February 11, 2026 | ransomware_live | — |
| Auto Auction of New England | February 10, 2026 | ransomware_live | — |
| Oklahoma Auto Exchange | February 10, 2026 | ransomware_live | — |
| Tropic Tool & Mold | February 10, 2026 | ransomware_live | — |
| Makivik | February 9, 2026 | ransomware_live | — |
| Catalanatto & Barnes | February 8, 2026 | ransomware_live | — |
| Altak | February 8, 2026 | ransomware_live | — |
| ESS Metron | February 7, 2026 | ransomware_live | — |
| UCG Associates | February 7, 2026 | ransomware_live | — |
| HMA | February 6, 2026 | ransomware_live | — |
| Unified Engineering | February 6, 2026 | ransomware_live | — |
| Heartland Title Services | February 6, 2026 | ransomware_live | — |
| Infinity Systems | February 6, 2026 | ransomware_live | — |
| Branagh | February 5, 2026 | ransomware_live | — |
| ISTS | February 4, 2026 | ransomware_live | — |
| Barnes Solicitors LLP | February 4, 2026 | ransomware_live | — |
| Ilderton Contracting | February 2, 2026 | ransomware_live | — |
| Transaction Packing | January 31, 2026 | ransomware_live | — |
| De Gruyter Brill | January 31, 2026 | ransomware_live | — |
| RAL Companies | January 30, 2026 | ransomware_live | — |
| Bloom's Bus Lines | January 30, 2026 | ransomware_live | — |
| Lusamerica Foods | January 30, 2026 | ransomware_live | — |
| KaiserAir | January 28, 2026 | ransomware_live | — |
| Tele Plus | January 26, 2026 | ransomware_live | — |
| Deatak | January 26, 2026 | ransomware_live | — |
| Bar S Services | January 25, 2026 | ransomware_live | — |
| F&B Mfg | January 23, 2026 | ransomware_live | — |
| NAI Plotkin | January 23, 2026 | ransomware_live | — |
| CBH Homes | January 23, 2026 | ransomware_live | — |
| Spring Brook Country Club | January 23, 2026 | ransomware_live | — |
| Quantum Fuel Systems Technologies | January 22, 2026 | ransomware_live | — |
| Woodfield | January 21, 2026 | ransomware_live | — |
| Christine London | January 20, 2026 | ransomware_live | — |
| Milwaukee Forge | January 20, 2026 | ransomware_live | — |
| Aquatic Control | January 19, 2026 | ransomware_live | — |
| Joyva | January 18, 2026 | ransomware_live | — |
| California Tax Data | January 17, 2026 | ransomware_live | — |
| TREC Group | January 15, 2026 | ransomware_live | — |
| Encore Roofing | January 14, 2026 | ransomware_live | — |
| Midway Windows and Doors | January 13, 2026 | ransomware_live | — |
| Eastern Ice | January 12, 2026 | ransomware_live | — |
| Riverwood Golf Club | January 12, 2026 | ransomware_live | — |
| Ampex Data Systems | January 12, 2026 | ransomware_live | — |
| CE Electronics | January 9, 2026 | ransomware_live | — |
| Routten & Laster Law | January 6, 2026 | ransomware_live | — |
| Raymundos Food Group | January 4, 2026 | ransomware_live | — |
| Garner Foods | January 2, 2026 | ransomware_live | — |
| C&r Electric | December 29, 2025 | ransomware_live | — |
| Genoa Lakes | December 29, 2025 | ransomware_live | — |
| Lakeside Title Company | December 29, 2025 | ransomware_live | — |
| WiZiX Technology Group | December 28, 2025 | ransomware_live | — |
| MP Filtri | December 26, 2025 | ransomware_live | — |
| JZ Russell Industries | December 26, 2025 | ransomware_live | — |
| Stoughton Steel | December 26, 2025 | ransomware_live | — |
| Rockport Technology Group | December 26, 2025 | ransomware_live | — |
| Pewarchuk CPA | December 26, 2025 | ransomware_live | — |
| Wardell Builders | December 26, 2025 | ransomware_live | — |
| Due Doyle Fanning | December 26, 2025 | ransomware_live | — |
| Denny's 5th Avenue Bakery | December 26, 2025 | ransomware_live | — |
| Launie & Marino | December 24, 2025 | ransomware_live | — |
| Security ONE Alarm Systems | December 20, 2025 | ransomware_live | — |
| Benise-Dowling & Associates | December 18, 2025 | ransomware_live | — |
| Kucera International | December 11, 2025 | ransomware_live | — |
| Gordon/Clifford Realty | December 11, 2025 | ransomware_live | — |
| Allure Home Creation | December 8, 2025 | ransomware_live | — |
| Mill Brothers | December 8, 2025 | ransomware_live | — |
| PHA Body Systems | December 1, 2025 | ransomware_live | — |
| Choates HVAC | November 26, 2025 | ransomware_live | — |
| University Loft | November 25, 2025 | ransomware_live | — |
| Eastman Cooke | November 25, 2025 | ransomware_live | — |
| Fairgrove Oil | November 25, 2025 | ransomware_live | — |
| South Island Public Service District | November 24, 2025 | ransomware_live | — |
| Jabezco Industrial Group | November 24, 2025 | ransomware_live | — |
| Release Marine | November 24, 2025 | ransomware_live | — |
| Hall Aluminum Products | November 21, 2025 | ransomware_live | — |
| Clark & Sullivan Constructors | November 21, 2025 | ransomware_live | — |
| Viga Eatery | November 19, 2025 | ransomware_live | — |
| Turkstra Trusses | November 18, 2025 | ransomware_live | — |
| Keystone Fabricating | November 18, 2025 | ransomware_live | — |
| Katch Kan | November 18, 2025 | ransomware_live | — |
| Maypay Farms Inc | November 18, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).