play
First seen November 26, 2022Active1,342 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Holiday Comfort | February 24, 2025 | ransomware_live | — |
| International Process Plants | February 21, 2025 | ransomware_live | — |
| Compound Solutions | February 20, 2025 | ransomware_live | — |
| Pre Con Industries | February 19, 2025 | ransomware_live | — |
| Nor Arc | February 18, 2025 | ransomware_live | — |
| Dectron | February 18, 2025 | ransomware_live | — |
| INS Quebec | February 18, 2025 | ransomware_live | — |
| Cuna Supply | February 17, 2025 | ransomware_live | — |
| Couri Insurance Agency | February 17, 2025 | ransomware_live | — |
| T J Machine & Tool | February 17, 2025 | ransomware_live | — |
| Finck Cigar | February 16, 2025 | ransomware_live | — |
| Fairhaven Shipyard Companies | February 14, 2025 | ransomware_live | — |
| Clawson Honda | February 14, 2025 | ransomware_live | — |
| Muller Insurance | February 12, 2025 | ransomware_live | — |
| Buckley BalaWilson Mew | February 12, 2025 | ransomware_live | — |
| Peak Season | February 12, 2025 | ransomware_live | — |
| Mainline Information Systems | February 11, 2025 | ransomware_live | — |
| Jildor Shoes | February 11, 2025 | ransomware_live | — |
| Inland Empire Distribution Systems, Inc. | February 11, 2025 | ransomware_live | — |
| The Townsley Law Firm Information | February 11, 2025 | ransomware_live | — |
| Convert Solar | February 11, 2025 | ransomware_live | — |
| Stage 3 Separation | February 9, 2025 | ransomware_live | — |
| Transkid | February 7, 2025 | ransomware_live | — |
| First Federal Savings & Loan | February 7, 2025 | ransomware_live | — |
| Bulldog Oilfield Services | February 6, 2025 | ransomware_live | — |
| Weed Man Canada | February 6, 2025 | ransomware_live | — |
| Island Realty | February 6, 2025 | ransomware_live | — |
| Radco Industries | February 6, 2025 | ransomware_live | — |
| North American Fire Hose | February 6, 2025 | ransomware_live | — |
| Ratioparts | February 5, 2025 | ransomware_live | — |
| Hydronic & Steam Equipment | February 5, 2025 | ransomware_live | — |
| 3cBSI | February 5, 2025 | ransomware_live | — |
| Gevril | February 5, 2025 | ransomware_live | — |
| NESCTC | February 5, 2025 | ransomware_live | — |
| Oxford Companies | February 4, 2025 | ransomware_live | — |
| Optometrics | February 3, 2025 | ransomware_live | — |
| Shinn Fu Company of America | January 31, 2025 | ransomware_live | — |
| Baltimore Country Club | January 31, 2025 | ransomware_live | — |
| EAC Consulting | January 31, 2025 | ransomware_live | — |
| Kensington Glass Arts | January 31, 2025 | ransomware_live | — |
| Monroe Transportation Services Inc | January 31, 2025 | ransomware_live | — |
| Tie Down Engineering | January 31, 2025 | ransomware_live | — |
| Story Environmental | January 31, 2025 | ransomware_live | — |
| CST Corp | January 30, 2025 | ransomware_live | — |
| Kimco Steel | January 30, 2025 | ransomware_live | — |
| Commercial & Residential Management Group | January 29, 2025 | ransomware_live | — |
| Cahoon Farms | January 29, 2025 | ransomware_live | — |
| Neaton Auto Products Manufacturing | January 29, 2025 | ransomware_live | — |
| Rheinischer Sch | January 28, 2025 | ransomware_live | — |
| Wylie Steel Fabricators | January 27, 2025 | ransomware_live | — |
| Best Cheer Stone | January 27, 2025 | ransomware_live | — |
| QGS Development | January 24, 2025 | ransomware_live | — |
| Shields Facilities Maintenance | January 24, 2025 | ransomware_live | — |
| Startek Peglar & Calcagni | January 22, 2025 | ransomware_live | — |
| Sheridan Nurseries | January 21, 2025 | ransomware_live | — |
| Mid-State Machine & Fabricating Corp | January 21, 2025 | ransomware_live | — |
| The Hill Brush | January 20, 2025 | ransomware_live | — |
| Woodway USA | January 17, 2025 | ransomware_live | — |
| Cold Storage Manufacturing | January 17, 2025 | ransomware_live | — |
| By design | January 16, 2025 | ransomware_live | — |
| Daniel Island Club | January 15, 2025 | ransomware_live | — |
| Plymouth Foam | January 14, 2025 | ransomware_live | — |
| KWS | January 14, 2025 | ransomware_live | — |
| ROCK SOLID Stabilization & Reclamation | January 13, 2025 | ransomware_live | — |
| PAC Strapping Products | January 13, 2025 | ransomware_live | — |
| Dickerson & Nieman Realtors | January 7, 2025 | ransomware_live | — |
| Bushmans | January 6, 2025 | ransomware_live | — |
| Dickow Cyzak Tile | January 6, 2025 | ransomware_live | — |
| Marshall & Bruce Printing | December 21, 2024 | ransomware_live | — |
| Zeifmans | December 20, 2024 | ransomware_live | — |
| Wallin & Klarich | December 20, 2024 | ransomware_live | — |
| daVinci | December 20, 2024 | ransomware_live | — |
| Night Hawk | December 20, 2024 | ransomware_live | — |
| TRIVAD | December 18, 2024 | ransomware_live | — |
| Cimarron Telephone Company | December 17, 2024 | ransomware_live | — |
| Maxus Group | December 12, 2024 | ransomware_live | — |
| Sigarth | December 12, 2024 | ransomware_live | — |
| Joshua Grading & Excavating | December 11, 2024 | ransomware_live | — |
| Luxury Yacht Group | December 11, 2024 | ransomware_live | — |
| Chemitex SA Information | December 10, 2024 | ransomware_live | — |
| Bettisworth North | December 10, 2024 | ransomware_live | — |
| South Plains Implement | December 9, 2024 | ransomware_live | — |
| McCray Lumber | December 6, 2024 | ransomware_live | — |
| Sunline | December 4, 2024 | ransomware_live | — |
| Long Beach Convention Center | December 3, 2024 | ransomware_live | — |
| Welker | December 3, 2024 | ransomware_live | — |
| Trace3 | November 29, 2024 | ransomware_live | — |
| SBW | November 28, 2024 | ransomware_live | — |
| Max Trans | November 27, 2024 | ransomware_live | — |
| DPC Development | November 27, 2024 | ransomware_live | — |
| Standard Calibrations | November 25, 2024 | ransomware_live | — |
| ITO EN | November 22, 2024 | ransomware_live | — |
| Arnott | November 22, 2024 | ransomware_live | — |
| Krispy Kreme | November 21, 2024 | ransomware_live | — |
| Hive Power Engineering | November 19, 2024 | ransomware_live | — |
| Dairy Farmers of Canada | November 19, 2024 | ransomware_live | — |
| Lanigan Ryan | November 18, 2024 | ransomware_live | — |
| Hatfield Consultants | November 13, 2024 | ransomware_live | — |
| Henderson Stamping & Production | November 7, 2024 | ransomware_live | — |
| Specialty Bolt And Screw | November 7, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).