play
First seen November 26, 2022Active1,308 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| EIZO Rugged Solutions | May 2, 2025 | ransomware_live | — |
| Dishaka | May 2, 2025 | ransomware_live | — |
| Custom Paper | May 1, 2025 | ransomware_live | — |
| Southern Fidelity | May 1, 2025 | ransomware_live | — |
| Downtown Travel | April 29, 2025 | ransomware_live | — |
| Rand Technology | April 28, 2025 | ransomware_live | — |
| Crawford Door Sales | April 27, 2025 | ransomware_live | — |
| Trybus | April 27, 2025 | ransomware_live | — |
| Technical Die-Casting | April 26, 2025 | ransomware_live | — |
| Marine Technical Surveyors | April 26, 2025 | ransomware_live | — |
| Breen Construction Services | April 26, 2025 | ransomware_live | — |
| Missouri Pipe Fittings | April 24, 2025 | ransomware_live | — |
| PermaCold Engineering | April 24, 2025 | ransomware_live | — |
| Webcor | April 24, 2025 | ransomware_live | — |
| Mantel Machine Products | April 23, 2025 | ransomware_live | — |
| The Seydel Companies | April 23, 2025 | ransomware_live | — |
| Scientel Solutions | April 22, 2025 | ransomware_live | — |
| Gorham Sand & Gravel | April 22, 2025 | ransomware_live | — |
| ATI Systems | April 21, 2025 | ransomware_live | — |
| Haas & Associates | April 19, 2025 | ransomware_live | — |
| BOLL Logistik | April 17, 2025 | ransomware_live | — |
| ECOM America | April 17, 2025 | ransomware_live | — |
| Independent Financial Services | April 16, 2025 | ransomware_live | — |
| Merri-Makers | April 14, 2025 | ransomware_live | — |
| Comport Technology Solutions | April 14, 2025 | ransomware_live | — |
| The Human Bean | April 14, 2025 | ransomware_live | — |
| C?l???t Group | April 11, 2025 | ransomware_live | — |
| Red Chamber | April 11, 2025 | ransomware_live | — |
| Cortez Resources | April 9, 2025 | ransomware_live | — |
| Waller | April 9, 2025 | ransomware_live | — |
| Suburban Carting | April 9, 2025 | ransomware_live | — |
| Cooper Global Chauffeured | April 9, 2025 | ransomware_live | — |
| The Study | April 5, 2025 | ransomware_live | — |
| Fraser Trebilcock | April 4, 2025 | ransomware_live | — |
| Sfrent.net | April 4, 2025 | ransomware_live | — |
| Voigt-Abernathy Company | April 4, 2025 | ransomware_live | — |
| Frederick's Machine & Tool Shop | April 4, 2025 | ransomware_live | — |
| Destination Toronto | April 3, 2025 | ransomware_live | — |
| Codinter | April 2, 2025 | ransomware_live | — |
| New York Sports Club | April 1, 2025 | ransomware_live | — |
| KER Custom Molders | March 31, 2025 | ransomware_live | — |
| Noyen Construction | March 31, 2025 | ransomware_live | — |
| Calmont Group | March 29, 2025 | ransomware_live | — |
| ABITL Finishing | March 28, 2025 | ransomware_live | — |
| Defected Records | March 28, 2025 | ransomware_live | — |
| Cane Creek Cycling Components | March 27, 2025 | ransomware_live | — |
| O'Brien & Ryan | March 27, 2025 | ransomware_live | — |
| Hawk Technology | March 26, 2025 | ransomware_live | — |
| Baltimore Steel Erectors | March 26, 2025 | ransomware_live | — |
| Bonick Landscaping | March 26, 2025 | ransomware_live | — |
| James & Sons Fine Jewelers | March 26, 2025 | ransomware_live | — |
| usCalibration | March 25, 2025 | ransomware_live | — |
| Csm Engineering | March 25, 2025 | ransomware_live | — |
| Hop Industries | March 24, 2025 | ransomware_live | — |
| Lifebreath | March 23, 2025 | ransomware_live | — |
| OTA Management | March 22, 2025 | ransomware_live | — |
| Regionale Verkehrsbetriebe | March 21, 2025 | ransomware_live | — |
| Parvin-Clauss Sign Company | March 21, 2025 | ransomware_live | — |
| Royal Glass | March 21, 2025 | ransomware_live | — |
| Fulfillment Plus | March 20, 2025 | ransomware_live | — |
| B&C Industries | March 19, 2025 | ransomware_live | — |
| All Book Covers | March 18, 2025 | ransomware_live | — |
| REOC San Antonio | March 17, 2025 | ransomware_live | — |
| Jet Ice | March 17, 2025 | ransomware_live | — |
| Kivells | March 16, 2025 | ransomware_live | — |
| SL Tennessee Information | March 13, 2025 | ransomware_live | — |
| Zaveta Custom Homes | March 10, 2025 | ransomware_live | — |
| FMT Consultants | March 10, 2025 | ransomware_live | — |
| Esquire Brands | March 6, 2025 | ransomware_live | — |
| Tulsat | March 4, 2025 | ransomware_live | — |
| Jerue Companies | March 3, 2025 | ransomware_live | — |
| Ganong Bros | March 2, 2025 | ransomware_live | — |
| IT-IQ Botswana | March 2, 2025 | ransomware_live | — |
| Syma-System | February 27, 2025 | ransomware_live | — |
| ALCOTT HR GROUP | February 25, 2025 | ransomware_live | — |
| Holiday Comfort | February 24, 2025 | ransomware_live | — |
| International Process Plants | February 21, 2025 | ransomware_live | — |
| Compound Solutions | February 20, 2025 | ransomware_live | — |
| Pre Con Industries | February 19, 2025 | ransomware_live | — |
| Nor Arc | February 18, 2025 | ransomware_live | — |
| Dectron | February 18, 2025 | ransomware_live | — |
| INS Quebec | February 18, 2025 | ransomware_live | — |
| Cuna Supply | February 17, 2025 | ransomware_live | — |
| Couri Insurance Agency | February 17, 2025 | ransomware_live | — |
| T J Machine & Tool | February 17, 2025 | ransomware_live | — |
| Finck Cigar | February 16, 2025 | ransomware_live | — |
| Fairhaven Shipyard Companies | February 14, 2025 | ransomware_live | — |
| Clawson Honda | February 14, 2025 | ransomware_live | — |
| Muller Insurance | February 12, 2025 | ransomware_live | — |
| Buckley BalaWilson Mew | February 12, 2025 | ransomware_live | — |
| Peak Season | February 12, 2025 | ransomware_live | — |
| Mainline Information Systems | February 11, 2025 | ransomware_live | — |
| Jildor Shoes | February 11, 2025 | ransomware_live | — |
| Inland Empire Distribution Systems, Inc. | February 11, 2025 | ransomware_live | — |
| The Townsley Law Firm Information | February 11, 2025 | ransomware_live | — |
| Convert Solar | February 11, 2025 | ransomware_live | — |
| Stage 3 Separation | February 9, 2025 | ransomware_live | — |
| Transkid | February 7, 2025 | ransomware_live | — |
| First Federal Savings & Loan | February 7, 2025 | ransomware_live | — |
| Bulldog Oilfield Services | February 6, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).