play
First seen November 26, 2022Active1,308 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Applied Energy Systems | November 17, 2025 | ransomware_live | — |
| Radio Sound | November 17, 2025 | ransomware_live | — |
| One Source Associates | November 13, 2025 | ransomware_live | — |
| Artesian Insurance | November 13, 2025 | ransomware_live | — |
| Highmark Companies | November 11, 2025 | ransomware_live | — |
| Valley Plains Equipment | November 10, 2025 | ransomware_live | — |
| N C Machinery | November 10, 2025 | ransomware_live | — |
| Garvin Promotion Group | November 6, 2025 | ransomware_live | — |
| Sellers Publishing | November 5, 2025 | ransomware_live | — |
| Aspen Distribution | November 4, 2025 | ransomware_live | — |
| Carlton Scale | November 3, 2025 | ransomware_live | — |
| Ioxo & Stream Computers | October 31, 2025 | ransomware_live | — |
| Kwik Mix Materials | October 31, 2025 | ransomware_live | — |
| BK Precision | October 30, 2025 | ransomware_live | — |
| Land Title Guaranty | October 29, 2025 | ransomware_live | — |
| Kitchen Design Concepts | October 28, 2025 | ransomware_live | — |
| Henry Raymond & Thompson | October 28, 2025 | ransomware_live | — |
| Irwin Car | October 28, 2025 | ransomware_live | — |
| American PowerNet | October 28, 2025 | ransomware_live | — |
| Sellars Absorbent Materials | October 28, 2025 | ransomware_live | — |
| ConvExx | October 28, 2025 | ransomware_live | — |
| Furniture Plus | October 27, 2025 | ransomware_live | — |
| Darvin Furniture | October 25, 2025 | ransomware_live | — |
| Encore Repair Services | October 24, 2025 | ransomware_live | — |
| Professional's Choice Sports | October 24, 2025 | ransomware_live | — |
| Ouranos | October 23, 2025 | ransomware_live | — |
| Aphase II | October 23, 2025 | ransomware_live | — |
| Super Quik | October 23, 2025 | ransomware_live | — |
| Evogence | October 23, 2025 | ransomware_live | — |
| Tavo Packaging Inc | October 23, 2025 | ransomware_live | — |
| Fast Freight | October 21, 2025 | ransomware_live | — |
| Wright Tool | October 21, 2025 | ransomware_live | — |
| LaBonne | October 20, 2025 | ransomware_live | — |
| Accord Carton | October 19, 2025 | ransomware_live | — |
| Sylvester Roofing | October 17, 2025 | ransomware_live | — |
| Global Shop Solutions | October 15, 2025 | ransomware_live | — |
| Cottage | October 14, 2025 | ransomware_live | — |
| Metal Pros | October 14, 2025 | ransomware_live | — |
| National Coatings | October 13, 2025 | ransomware_live | — |
| Cellucap Manufacturing | October 12, 2025 | ransomware_live | — |
| Legacy Manufacturing | October 11, 2025 | ransomware_live | — |
| Nelligan White Architects | October 8, 2025 | ransomware_live | — |
| Elmer W. Davis | October 1, 2025 | ransomware_live | — |
| Accelerated | October 1, 2025 | ransomware_live | — |
| BMP Worldwide | October 1, 2025 | ransomware_live | — |
| Dataforth | September 29, 2025 | ransomware_live | — |
| ComTec Systems | September 23, 2025 | ransomware_live | — |
| Pangborn | September 23, 2025 | ransomware_live | — |
| Vcinity | September 22, 2025 | ransomware_live | — |
| Steve Basso Plumbing Heating | September 21, 2025 | ransomware_live | — |
| Komar Industries | September 21, 2025 | ransomware_live | — |
| United Machine | September 19, 2025 | ransomware_live | — |
| Earthadelic | September 18, 2025 | ransomware_live | — |
| DHM Properties | September 17, 2025 | ransomware_live | — |
| Marwood | September 17, 2025 | ransomware_live | — |
| Amelia Overhead Doors | September 16, 2025 | ransomware_live | — |
| New England Waterproofing | September 14, 2025 | ransomware_live | — |
| Atlas Pressed Metals | September 14, 2025 | ransomware_live | — |
| PTR | September 12, 2025 | ransomware_live | — |
| Combined Services HVAC | September 12, 2025 | ransomware_live | — |
| APG | September 12, 2025 | ransomware_live | — |
| RGR Sportswear | September 11, 2025 | ransomware_live | — |
| GrammaTech | September 11, 2025 | ransomware_live | — |
| Roth & Scholl | September 10, 2025 | ransomware_live | — |
| GL Veneer | September 9, 2025 | ransomware_live | — |
| Cool Wind Ventilation | September 9, 2025 | ransomware_live | — |
| Energenecs | September 9, 2025 | ransomware_live | — |
| Eau Palm Beach Resort & Spa | September 9, 2025 | ransomware_live | — |
| Promark Partners | September 8, 2025 | ransomware_live | — |
| McCarter Electrical | September 8, 2025 | ransomware_live | — |
| Garrison Architects | September 8, 2025 | ransomware_live | — |
| Hilldun | September 8, 2025 | ransomware_live | — |
| General Control Systems | September 7, 2025 | ransomware_live | — |
| Thomas Safran & Associates | September 7, 2025 | ransomware_live | — |
| Ronco Safety | September 6, 2025 | ransomware_live | — |
| Baum Precision Machining | September 5, 2025 | ransomware_live | — |
| RFI | September 5, 2025 | ransomware_live | — |
| Pathfinder | September 5, 2025 | ransomware_live | — |
| Royal Thai | September 5, 2025 | ransomware_live | — |
| Agility CIS | September 4, 2025 | ransomware_live | — |
| Mayors Machine Works | September 2, 2025 | ransomware_live | — |
| Reliable Roofing | August 30, 2025 | ransomware_live | — |
| Celtic Engineering | August 29, 2025 | ransomware_live | — |
| Royal Machine & Tool | August 29, 2025 | ransomware_live | — |
| JIT Energy Services | August 29, 2025 | ransomware_live | — |
| BDE Computer Services | August 28, 2025 | ransomware_live | — |
| Energy Fishing | August 28, 2025 | ransomware_live | — |
| Rochester Optical | August 28, 2025 | ransomware_live | — |
| TerranearPMC | August 28, 2025 | ransomware_live | — |
| Arboris | August 27, 2025 | ransomware_live | — |
| Edwards Interiors | August 27, 2025 | ransomware_live | — |
| Banville Wine Merchants | August 26, 2025 | ransomware_live | — |
| Juggernaut | August 25, 2025 | ransomware_live | — |
| Logan & Mencuccini | August 23, 2025 | ransomware_live | — |
| All States Materials Group | August 22, 2025 | ransomware_live | — |
| Vanderpool Construction | August 22, 2025 | ransomware_live | — |
| Edward J McKarski | August 21, 2025 | ransomware_live | — |
| Anderson Aluminum | August 19, 2025 | ransomware_live | — |
| Galaxy Freightline | August 18, 2025 | ransomware_live | — |
| Premier Realty Group | August 15, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).