play
First seen November 26, 2022Active1,308 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Weed Man Canada | February 6, 2025 | ransomware_live | — |
| Island Realty | February 6, 2025 | ransomware_live | — |
| Radco Industries | February 6, 2025 | ransomware_live | — |
| North American Fire Hose | February 6, 2025 | ransomware_live | — |
| Ratioparts | February 5, 2025 | ransomware_live | — |
| Hydronic & Steam Equipment | February 5, 2025 | ransomware_live | — |
| 3cBSI | February 5, 2025 | ransomware_live | — |
| Gevril | February 5, 2025 | ransomware_live | — |
| NESCTC | February 5, 2025 | ransomware_live | — |
| Oxford Companies | February 4, 2025 | ransomware_live | — |
| Optometrics | February 3, 2025 | ransomware_live | — |
| Shinn Fu Company of America | January 31, 2025 | ransomware_live | — |
| Baltimore Country Club | January 31, 2025 | ransomware_live | — |
| EAC Consulting | January 31, 2025 | ransomware_live | — |
| Kensington Glass Arts | January 31, 2025 | ransomware_live | — |
| Monroe Transportation Services Inc | January 31, 2025 | ransomware_live | — |
| Tie Down Engineering | January 31, 2025 | ransomware_live | — |
| Story Environmental | January 31, 2025 | ransomware_live | — |
| CST Corp | January 30, 2025 | ransomware_live | — |
| Kimco Steel | January 30, 2025 | ransomware_live | — |
| Commercial & Residential Management Group | January 29, 2025 | ransomware_live | — |
| Cahoon Farms | January 29, 2025 | ransomware_live | — |
| Neaton Auto Products Manufacturing | January 29, 2025 | ransomware_live | — |
| Rheinischer Sch | January 28, 2025 | ransomware_live | — |
| Wylie Steel Fabricators | January 27, 2025 | ransomware_live | — |
| Best Cheer Stone | January 27, 2025 | ransomware_live | — |
| QGS Development | January 24, 2025 | ransomware_live | — |
| Shields Facilities Maintenance | January 24, 2025 | ransomware_live | — |
| Startek Peglar & Calcagni | January 22, 2025 | ransomware_live | — |
| Sheridan Nurseries | January 21, 2025 | ransomware_live | — |
| Mid-State Machine & Fabricating Corp | January 21, 2025 | ransomware_live | — |
| The Hill Brush | January 20, 2025 | ransomware_live | — |
| Woodway USA | January 17, 2025 | ransomware_live | — |
| Cold Storage Manufacturing | January 17, 2025 | ransomware_live | — |
| By design | January 16, 2025 | ransomware_live | — |
| Daniel Island Club | January 15, 2025 | ransomware_live | — |
| Plymouth Foam | January 14, 2025 | ransomware_live | — |
| KWS | January 14, 2025 | ransomware_live | — |
| ROCK SOLID Stabilization & Reclamation | January 13, 2025 | ransomware_live | — |
| PAC Strapping Products | January 13, 2025 | ransomware_live | — |
| Dickerson & Nieman Realtors | January 7, 2025 | ransomware_live | — |
| Bushmans | January 6, 2025 | ransomware_live | — |
| Dickow Cyzak Tile | January 6, 2025 | ransomware_live | — |
| Marshall & Bruce Printing | December 21, 2024 | ransomware_live | — |
| Zeifmans | December 20, 2024 | ransomware_live | — |
| Wallin & Klarich | December 20, 2024 | ransomware_live | — |
| daVinci | December 20, 2024 | ransomware_live | — |
| Night Hawk | December 20, 2024 | ransomware_live | — |
| TRIVAD | December 18, 2024 | ransomware_live | — |
| Cimarron Telephone Company | December 17, 2024 | ransomware_live | — |
| Maxus Group | December 12, 2024 | ransomware_live | — |
| Sigarth | December 12, 2024 | ransomware_live | — |
| Joshua Grading & Excavating | December 11, 2024 | ransomware_live | — |
| Luxury Yacht Group | December 11, 2024 | ransomware_live | — |
| Chemitex SA Information | December 10, 2024 | ransomware_live | — |
| Bettisworth North | December 10, 2024 | ransomware_live | — |
| South Plains Implement | December 9, 2024 | ransomware_live | — |
| McCray Lumber | December 6, 2024 | ransomware_live | — |
| Sunline | December 4, 2024 | ransomware_live | — |
| Long Beach Convention Center | December 3, 2024 | ransomware_live | — |
| Welker | December 3, 2024 | ransomware_live | — |
| Trace3 | November 29, 2024 | ransomware_live | — |
| SBW | November 28, 2024 | ransomware_live | — |
| Max Trans | November 27, 2024 | ransomware_live | — |
| DPC Development | November 27, 2024 | ransomware_live | — |
| Standard Calibrations | November 25, 2024 | ransomware_live | — |
| ITO EN | November 22, 2024 | ransomware_live | — |
| Arnott | November 22, 2024 | ransomware_live | — |
| Krispy Kreme | November 21, 2024 | ransomware_live | — |
| Hive Power Engineering | November 19, 2024 | ransomware_live | — |
| Dairy Farmers of Canada | November 19, 2024 | ransomware_live | — |
| Lanigan Ryan | November 18, 2024 | ransomware_live | — |
| Hatfield Consultants | November 13, 2024 | ransomware_live | — |
| Henderson Stamping & Production | November 7, 2024 | ransomware_live | — |
| Specialty Bolt And Screw | November 7, 2024 | ransomware_live | — |
| Miller & Smith | November 5, 2024 | ransomware_live | — |
| Delfin Design & Manufacturing | November 2, 2024 | ransomware_live | — |
| Smitty's Supply | October 31, 2024 | ransomware_live | — |
| Dirksen Screw Products | October 29, 2024 | ransomware_live | — |
| S & W Kitchens | October 29, 2024 | ransomware_live | — |
| Bendheim | October 29, 2024 | ransomware_live | — |
| TV Guide Magazine | October 26, 2024 | ransomware_live | — |
| Pureflow Airdog | October 25, 2024 | ransomware_live | — |
| Vox Printing | October 25, 2024 | ransomware_live | — |
| Unlimited Lawn Care | October 24, 2024 | ransomware_live | — |
| Birdair | October 24, 2024 | ransomware_live | — |
| LenelS2 | October 24, 2024 | ransomware_live | — |
| Diamond Brand Gear | October 23, 2024 | ransomware_live | — |
| Positive Business Solutions | October 22, 2024 | ransomware_live | — |
| IVC Technologies | October 22, 2024 | ransomware_live | — |
| Postcard Mania | October 21, 2024 | ransomware_live | — |
| CGR Technologies | October 19, 2024 | ransomware_live | — |
| Mainelli Mechanical Contractors | October 18, 2024 | ransomware_live | — |
| Iron World Manufacturing | October 18, 2024 | ransomware_live | — |
| Pelsue | October 18, 2024 | ransomware_live | — |
| W?l?????n | October 17, 2024 | ransomware_live | — |
| TU Parks | October 17, 2024 | ransomware_live | — |
| iFocus Consulting | October 17, 2024 | ransomware_live | — |
| Action Heating & Cooling | October 16, 2024 | ransomware_live | — |
| Eagle Industries | October 16, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).