play
First seen November 26, 2022Active1,308 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| AES Clean Technology | August 15, 2025 | ransomware_live | — |
| NextLabs | August 14, 2025 | ransomware_live | — |
| eShipGlobal | August 14, 2025 | ransomware_live | — |
| Greenscape Pump Services | August 14, 2025 | ransomware_live | — |
| Omega Global Technologies | August 14, 2025 | ransomware_live | — |
| CBG Surveying Texas | August 14, 2025 | ransomware_live | — |
| ABcom | August 10, 2025 | ransomware_live | — |
| Bluewater Yacht Sales | August 7, 2025 | ransomware_live | — |
| The Scharine Group | August 7, 2025 | ransomware_live | — |
| Emprise | August 6, 2025 | ransomware_live | — |
| NEAS | August 6, 2025 | ransomware_live | — |
| Rite Track | August 6, 2025 | ransomware_live | — |
| Travancore Analytics | August 6, 2025 | ransomware_live | — |
| Rising Star Hydraulics | August 6, 2025 | ransomware_live | — |
| CFI Tire Service | August 4, 2025 | ransomware_live | — |
| RHI Supply | August 4, 2025 | ransomware_live | — |
| Jamco Aerospace | August 3, 2025 | ransomware_live | — |
| Quartus Engineering | July 31, 2025 | ransomware_live | — |
| Phoenix Lighting | July 30, 2025 | ransomware_live | — |
| Brad's Bedding Plants | July 30, 2025 | ransomware_live | — |
| Backstage Library Works | July 29, 2025 | ransomware_live | — |
| White Horse Packaging | July 28, 2025 | ransomware_live | — |
| The Magni Group | July 25, 2025 | ransomware_live | — |
| DA Whitacre Construction | July 23, 2025 | ransomware_live | — |
| Terillium | July 18, 2025 | ransomware_live | — |
| Ka Logistics | July 14, 2025 | ransomware_live | — |
| IMSSA Manufacturing | July 12, 2025 | ransomware_live | — |
| Rockrose Development | July 9, 2025 | ransomware_live | — |
| Wood, Patel & Associates | July 8, 2025 | ransomware_live | — |
| Wfmt | July 8, 2025 | ransomware_live | — |
| Lee Publications | July 7, 2025 | ransomware_live | — |
| Lydig Construction | July 3, 2025 | ransomware_live | — |
| JFC Electric | July 3, 2025 | ransomware_live | — |
| CyberlinkASP | July 3, 2025 | ransomware_live | — |
| Thern | July 3, 2025 | ransomware_live | — |
| Hulberg & Associates | July 2, 2025 | ransomware_live | — |
| Biofloral | July 1, 2025 | ransomware_live | — |
| Whim Hospitality | July 1, 2025 | ransomware_live | — |
| FormWood Industries | June 30, 2025 | ransomware_live | — |
| Tyree Oil | June 28, 2025 | ransomware_live | — |
| CGP&H | June 27, 2025 | ransomware_live | — |
| View Zuellig Industrial | June 27, 2025 | ransomware_live | — |
| Metric | June 27, 2025 | ransomware_live | — |
| ALLMAX | June 27, 2025 | ransomware_live | — |
| Advance Ready Mix | June 26, 2025 | ransomware_live | — |
| All Choice Rentals | June 25, 2025 | ransomware_live | — |
| Emtech Inc | June 24, 2025 | ransomware_live | — |
| Carter Manufacturing | June 24, 2025 | ransomware_live | — |
| Dairy Farmers of America | June 22, 2025 | ransomware_live | — |
| Fisher59 | June 22, 2025 | ransomware_live | — |
| Merlin Industries | June 22, 2025 | ransomware_live | — |
| Islington Golf Club | June 20, 2025 | ransomware_live | — |
| Sunrise Springs Spa Resort | June 19, 2025 | ransomware_live | — |
| Cartel Communication Systems | June 18, 2025 | ransomware_live | — |
| Associated Packaging | June 16, 2025 | ransomware_live | — |
| Vacation Myrtle Beach | June 15, 2025 | ransomware_live | — |
| Project Partners | June 14, 2025 | ransomware_live | — |
| Ovalstrapping | June 13, 2025 | ransomware_live | — |
| NF Stroth & Associates | June 12, 2025 | ransomware_live | — |
| Lake Book Manufacturing | June 12, 2025 | ransomware_live | — |
| Jasper Products | June 11, 2025 | ransomware_live | — |
| Place Homes | June 11, 2025 | ransomware_live | — |
| NPD Products | June 8, 2025 | ransomware_live | — |
| Rollex | June 8, 2025 | ransomware_live | — |
| S&H Express | June 7, 2025 | ransomware_live | — |
| Allied Steel Buildings | June 4, 2025 | ransomware_live | — |
| Rochon | May 31, 2025 | ransomware_live | — |
| Anchor Industries | May 30, 2025 | ransomware_live | — |
| FLOE Internationa | May 30, 2025 | ransomware_live | — |
| Capital Trade | May 30, 2025 | ransomware_live | — |
| Sorter Construction | May 30, 2025 | ransomware_live | — |
| Triumph Construction | May 30, 2025 | ransomware_live | — |
| Homestead Gardens | May 30, 2025 | ransomware_live | — |
| Ebac | May 29, 2025 | ransomware_live | — |
| Eliel Cycling | May 28, 2025 | ransomware_live | — |
| Community Choice Credit Union | May 28, 2025 | ransomware_live | — |
| Media Links | May 26, 2025 | ransomware_live | — |
| AKJ Energiteknik | May 23, 2025 | ransomware_live | — |
| WAT Supplies | May 23, 2025 | ransomware_live | — |
| CNHI LLC | May 21, 2025 | ransomware_live | — |
| KDV Label | May 20, 2025 | ransomware_live | — |
| W.E. Bowers | May 20, 2025 | ransomware_live | — |
| South Atlantic Federal Credit Union | May 19, 2025 | ransomware_live | — |
| Carney Badley Spellman | May 15, 2025 | ransomware_live | — |
| AttainX | May 15, 2025 | ransomware_live | — |
| Vernon Milling | May 15, 2025 | ransomware_live | — |
| Regal Ideas | May 14, 2025 | ransomware_live | — |
| Greater Seattle Concrete | May 14, 2025 | ransomware_live | — |
| K & K Fence | May 13, 2025 | ransomware_live | — |
| Grafton Technologies | May 12, 2025 | ransomware_live | — |
| Verrex | May 9, 2025 | ransomware_live | — |
| Operative | May 8, 2025 | ransomware_live | — |
| Overhead Door of Nova Scotia | May 7, 2025 | ransomware_live | — |
| Just Concrete & Masonry | May 6, 2025 | ransomware_live | — |
| Sugar Lake Lodge | May 5, 2025 | ransomware_live | — |
| Alberta Construction Safety Association | May 5, 2025 | ransomware_live | — |
| Novosit | May 5, 2025 | ransomware_live | — |
| EMX Enterprises | May 4, 2025 | ransomware_live | — |
| Gistic Research | May 2, 2025 | ransomware_live | — |
| Sweet Shop USA | May 2, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).