play
First seen November 26, 2022Active1,342 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Wardell Builders | December 26, 2025 | ransomware_live | — |
| Due Doyle Fanning | December 26, 2025 | ransomware_live | — |
| Denny's 5th Avenue Bakery | December 26, 2025 | ransomware_live | — |
| Launie & Marino | December 24, 2025 | ransomware_live | — |
| Security ONE Alarm Systems | December 20, 2025 | ransomware_live | — |
| Benise-Dowling & Associates | December 18, 2025 | ransomware_live | — |
| Kucera International | December 11, 2025 | ransomware_live | — |
| Gordon/Clifford Realty | December 11, 2025 | ransomware_live | — |
| Allure Home Creation | December 8, 2025 | ransomware_live | — |
| Mill Brothers | December 8, 2025 | ransomware_live | — |
| PHA Body Systems | December 1, 2025 | ransomware_live | — |
| Choates HVAC | November 26, 2025 | ransomware_live | — |
| University Loft | November 25, 2025 | ransomware_live | — |
| Eastman Cooke | November 25, 2025 | ransomware_live | — |
| Fairgrove Oil | November 25, 2025 | ransomware_live | — |
| South Island Public Service District | November 24, 2025 | ransomware_live | — |
| Jabezco Industrial Group | November 24, 2025 | ransomware_live | — |
| Release Marine | November 24, 2025 | ransomware_live | — |
| Hall Aluminum Products | November 21, 2025 | ransomware_live | — |
| Clark & Sullivan Constructors | November 21, 2025 | ransomware_live | — |
| Viga Eatery | November 19, 2025 | ransomware_live | — |
| Turkstra Trusses | November 18, 2025 | ransomware_live | — |
| Keystone Fabricating | November 18, 2025 | ransomware_live | — |
| Katch Kan | November 18, 2025 | ransomware_live | — |
| Maypay Farms Inc | November 18, 2025 | ransomware_live | — |
| Applied Energy Systems | November 17, 2025 | ransomware_live | — |
| Radio Sound | November 17, 2025 | ransomware_live | — |
| One Source Associates | November 13, 2025 | ransomware_live | — |
| Artesian Insurance | November 13, 2025 | ransomware_live | — |
| Highmark Companies | November 11, 2025 | ransomware_live | — |
| Valley Plains Equipment | November 10, 2025 | ransomware_live | — |
| N C Machinery | November 10, 2025 | ransomware_live | — |
| Garvin Promotion Group | November 6, 2025 | ransomware_live | — |
| Sellers Publishing | November 5, 2025 | ransomware_live | — |
| Aspen Distribution | November 4, 2025 | ransomware_live | — |
| Carlton Scale | November 3, 2025 | ransomware_live | — |
| Ioxo & Stream Computers | October 31, 2025 | ransomware_live | — |
| Kwik Mix Materials | October 31, 2025 | ransomware_live | — |
| BK Precision | October 30, 2025 | ransomware_live | — |
| Land Title Guaranty | October 29, 2025 | ransomware_live | — |
| Kitchen Design Concepts | October 28, 2025 | ransomware_live | — |
| Henry Raymond & Thompson | October 28, 2025 | ransomware_live | — |
| Irwin Car | October 28, 2025 | ransomware_live | — |
| American PowerNet | October 28, 2025 | ransomware_live | — |
| Sellars Absorbent Materials | October 28, 2025 | ransomware_live | — |
| ConvExx | October 28, 2025 | ransomware_live | — |
| Furniture Plus | October 27, 2025 | ransomware_live | — |
| Darvin Furniture | October 25, 2025 | ransomware_live | — |
| Encore Repair Services | October 24, 2025 | ransomware_live | — |
| Professional's Choice Sports | October 24, 2025 | ransomware_live | — |
| Ouranos | October 23, 2025 | ransomware_live | — |
| Aphase II | October 23, 2025 | ransomware_live | — |
| Super Quik | October 23, 2025 | ransomware_live | — |
| Evogence | October 23, 2025 | ransomware_live | — |
| Tavo Packaging Inc | October 23, 2025 | ransomware_live | — |
| Fast Freight | October 21, 2025 | ransomware_live | — |
| Wright Tool | October 21, 2025 | ransomware_live | — |
| LaBonne | October 20, 2025 | ransomware_live | — |
| Accord Carton | October 19, 2025 | ransomware_live | — |
| Sylvester Roofing | October 17, 2025 | ransomware_live | — |
| Global Shop Solutions | October 15, 2025 | ransomware_live | — |
| Cottage | October 14, 2025 | ransomware_live | — |
| Metal Pros | October 14, 2025 | ransomware_live | — |
| National Coatings | October 13, 2025 | ransomware_live | — |
| Cellucap Manufacturing | October 12, 2025 | ransomware_live | — |
| Legacy Manufacturing | October 11, 2025 | ransomware_live | — |
| Nelligan White Architects | October 8, 2025 | ransomware_live | — |
| Elmer W. Davis | October 1, 2025 | ransomware_live | — |
| Accelerated | October 1, 2025 | ransomware_live | — |
| BMP Worldwide | October 1, 2025 | ransomware_live | — |
| Dataforth | September 29, 2025 | ransomware_live | — |
| ComTec Systems | September 23, 2025 | ransomware_live | — |
| Pangborn | September 23, 2025 | ransomware_live | — |
| Vcinity | September 22, 2025 | ransomware_live | — |
| Steve Basso Plumbing Heating | September 21, 2025 | ransomware_live | — |
| Komar Industries | September 21, 2025 | ransomware_live | — |
| United Machine | September 19, 2025 | ransomware_live | — |
| Earthadelic | September 18, 2025 | ransomware_live | — |
| DHM Properties | September 17, 2025 | ransomware_live | — |
| Marwood | September 17, 2025 | ransomware_live | — |
| Amelia Overhead Doors | September 16, 2025 | ransomware_live | — |
| New England Waterproofing | September 14, 2025 | ransomware_live | — |
| Atlas Pressed Metals | September 14, 2025 | ransomware_live | — |
| PTR | September 12, 2025 | ransomware_live | — |
| Combined Services HVAC | September 12, 2025 | ransomware_live | — |
| APG | September 12, 2025 | ransomware_live | — |
| RGR Sportswear | September 11, 2025 | ransomware_live | — |
| GrammaTech | September 11, 2025 | ransomware_live | — |
| Roth & Scholl | September 10, 2025 | ransomware_live | — |
| GL Veneer | September 9, 2025 | ransomware_live | — |
| Cool Wind Ventilation | September 9, 2025 | ransomware_live | — |
| Energenecs | September 9, 2025 | ransomware_live | — |
| Eau Palm Beach Resort & Spa | September 9, 2025 | ransomware_live | — |
| Promark Partners | September 8, 2025 | ransomware_live | — |
| McCarter Electrical | September 8, 2025 | ransomware_live | — |
| Garrison Architects | September 8, 2025 | ransomware_live | — |
| Hilldun | September 8, 2025 | ransomware_live | — |
| General Control Systems | September 7, 2025 | ransomware_live | — |
| Thomas Safran & Associates | September 7, 2025 | ransomware_live | — |
| Ronco Safety | September 6, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).