play
First seen November 26, 2022Active1,342 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Community Choice Credit Union | May 28, 2025 | ransomware_live | — |
| Media Links | May 26, 2025 | ransomware_live | — |
| AKJ Energiteknik | May 23, 2025 | ransomware_live | — |
| WAT Supplies | May 23, 2025 | ransomware_live | — |
| CNHI LLC | May 21, 2025 | ransomware_live | — |
| KDV Label | May 20, 2025 | ransomware_live | — |
| W.E. Bowers | May 20, 2025 | ransomware_live | — |
| South Atlantic Federal Credit Union | May 19, 2025 | ransomware_live | — |
| Carney Badley Spellman | May 15, 2025 | ransomware_live | — |
| AttainX | May 15, 2025 | ransomware_live | — |
| Vernon Milling | May 15, 2025 | ransomware_live | — |
| Regal Ideas | May 14, 2025 | ransomware_live | — |
| Greater Seattle Concrete | May 14, 2025 | ransomware_live | — |
| K & K Fence | May 13, 2025 | ransomware_live | — |
| Grafton Technologies | May 12, 2025 | ransomware_live | — |
| Verrex | May 9, 2025 | ransomware_live | — |
| Operative | May 8, 2025 | ransomware_live | — |
| Overhead Door of Nova Scotia | May 7, 2025 | ransomware_live | — |
| Just Concrete & Masonry | May 6, 2025 | ransomware_live | — |
| Sugar Lake Lodge | May 5, 2025 | ransomware_live | — |
| Alberta Construction Safety Association | May 5, 2025 | ransomware_live | — |
| Novosit | May 5, 2025 | ransomware_live | — |
| EMX Enterprises | May 4, 2025 | ransomware_live | — |
| Gistic Research | May 2, 2025 | ransomware_live | — |
| Sweet Shop USA | May 2, 2025 | ransomware_live | — |
| EIZO Rugged Solutions | May 2, 2025 | ransomware_live | — |
| Dishaka | May 2, 2025 | ransomware_live | — |
| Custom Paper | May 1, 2025 | ransomware_live | — |
| Southern Fidelity | May 1, 2025 | ransomware_live | — |
| Downtown Travel | April 29, 2025 | ransomware_live | — |
| Rand Technology | April 28, 2025 | ransomware_live | — |
| Crawford Door Sales | April 27, 2025 | ransomware_live | — |
| Trybus | April 27, 2025 | ransomware_live | — |
| Technical Die-Casting | April 26, 2025 | ransomware_live | — |
| Marine Technical Surveyors | April 26, 2025 | ransomware_live | — |
| Breen Construction Services | April 26, 2025 | ransomware_live | — |
| Missouri Pipe Fittings | April 24, 2025 | ransomware_live | — |
| PermaCold Engineering | April 24, 2025 | ransomware_live | — |
| Webcor | April 24, 2025 | ransomware_live | — |
| Mantel Machine Products | April 23, 2025 | ransomware_live | — |
| The Seydel Companies | April 23, 2025 | ransomware_live | — |
| Scientel Solutions | April 22, 2025 | ransomware_live | — |
| Gorham Sand & Gravel | April 22, 2025 | ransomware_live | — |
| ATI Systems | April 21, 2025 | ransomware_live | — |
| Haas & Associates | April 19, 2025 | ransomware_live | — |
| BOLL Logistik | April 17, 2025 | ransomware_live | — |
| ECOM America | April 17, 2025 | ransomware_live | — |
| Independent Financial Services | April 16, 2025 | ransomware_live | — |
| Merri-Makers | April 14, 2025 | ransomware_live | — |
| Comport Technology Solutions | April 14, 2025 | ransomware_live | — |
| The Human Bean | April 14, 2025 | ransomware_live | — |
| C?l???t Group | April 11, 2025 | ransomware_live | — |
| Red Chamber | April 11, 2025 | ransomware_live | — |
| Cortez Resources | April 9, 2025 | ransomware_live | — |
| Waller | April 9, 2025 | ransomware_live | — |
| Suburban Carting | April 9, 2025 | ransomware_live | — |
| Cooper Global Chauffeured | April 9, 2025 | ransomware_live | — |
| The Study | April 5, 2025 | ransomware_live | — |
| Fraser Trebilcock | April 4, 2025 | ransomware_live | — |
| Sfrent.net | April 4, 2025 | ransomware_live | — |
| Voigt-Abernathy Company | April 4, 2025 | ransomware_live | — |
| Frederick's Machine & Tool Shop | April 4, 2025 | ransomware_live | — |
| Destination Toronto | April 3, 2025 | ransomware_live | — |
| Codinter | April 2, 2025 | ransomware_live | — |
| New York Sports Club | April 1, 2025 | ransomware_live | — |
| KER Custom Molders | March 31, 2025 | ransomware_live | — |
| Noyen Construction | March 31, 2025 | ransomware_live | — |
| Calmont Group | March 29, 2025 | ransomware_live | — |
| ABITL Finishing | March 28, 2025 | ransomware_live | — |
| Defected Records | March 28, 2025 | ransomware_live | — |
| Cane Creek Cycling Components | March 27, 2025 | ransomware_live | — |
| O'Brien & Ryan | March 27, 2025 | ransomware_live | — |
| Hawk Technology | March 26, 2025 | ransomware_live | — |
| Baltimore Steel Erectors | March 26, 2025 | ransomware_live | — |
| Bonick Landscaping | March 26, 2025 | ransomware_live | — |
| James & Sons Fine Jewelers | March 26, 2025 | ransomware_live | — |
| usCalibration | March 25, 2025 | ransomware_live | — |
| Csm Engineering | March 25, 2025 | ransomware_live | — |
| Hop Industries | March 24, 2025 | ransomware_live | — |
| Lifebreath | March 23, 2025 | ransomware_live | — |
| OTA Management | March 22, 2025 | ransomware_live | — |
| Regionale Verkehrsbetriebe | March 21, 2025 | ransomware_live | — |
| Parvin-Clauss Sign Company | March 21, 2025 | ransomware_live | — |
| Royal Glass | March 21, 2025 | ransomware_live | — |
| Fulfillment Plus | March 20, 2025 | ransomware_live | — |
| B&C Industries | March 19, 2025 | ransomware_live | — |
| All Book Covers | March 18, 2025 | ransomware_live | — |
| REOC San Antonio | March 17, 2025 | ransomware_live | — |
| Jet Ice | March 17, 2025 | ransomware_live | — |
| Kivells | March 16, 2025 | ransomware_live | — |
| SL Tennessee Information | March 13, 2025 | ransomware_live | — |
| Zaveta Custom Homes | March 10, 2025 | ransomware_live | — |
| FMT Consultants | March 10, 2025 | ransomware_live | — |
| Esquire Brands | March 6, 2025 | ransomware_live | — |
| Tulsat | March 4, 2025 | ransomware_live | — |
| Jerue Companies | March 3, 2025 | ransomware_live | — |
| Ganong Bros | March 2, 2025 | ransomware_live | — |
| IT-IQ Botswana | March 2, 2025 | ransomware_live | — |
| Syma-System | February 27, 2025 | ransomware_live | — |
| ALCOTT HR GROUP | February 25, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).