play
First seen November 26, 2022Active1,342 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Miller & Smith | November 5, 2024 | ransomware_live | — |
| Delfin Design & Manufacturing | November 2, 2024 | ransomware_live | — |
| Smitty's Supply | October 31, 2024 | ransomware_live | — |
| Dirksen Screw Products | October 29, 2024 | ransomware_live | — |
| S & W Kitchens | October 29, 2024 | ransomware_live | — |
| Bendheim | October 29, 2024 | ransomware_live | — |
| TV Guide Magazine | October 26, 2024 | ransomware_live | — |
| Pureflow Airdog | October 25, 2024 | ransomware_live | — |
| Vox Printing | October 25, 2024 | ransomware_live | — |
| Unlimited Lawn Care | October 24, 2024 | ransomware_live | — |
| Birdair | October 24, 2024 | ransomware_live | — |
| LenelS2 | October 24, 2024 | ransomware_live | — |
| Diamond Brand Gear | October 23, 2024 | ransomware_live | — |
| Positive Business Solutions | October 22, 2024 | ransomware_live | — |
| IVC Technologies | October 22, 2024 | ransomware_live | — |
| Postcard Mania | October 21, 2024 | ransomware_live | — |
| CGR Technologies | October 19, 2024 | ransomware_live | — |
| Mainelli Mechanical Contractors | October 18, 2024 | ransomware_live | — |
| Iron World Manufacturing | October 18, 2024 | ransomware_live | — |
| Pelsue | October 18, 2024 | ransomware_live | — |
| W?l?????n | October 17, 2024 | ransomware_live | — |
| TU Parks | October 17, 2024 | ransomware_live | — |
| iFocus Consulting | October 17, 2024 | ransomware_live | — |
| Action Heating & Cooling | October 16, 2024 | ransomware_live | — |
| Eagle Industries | October 16, 2024 | ransomware_live | — |
| C & C Industries | October 16, 2024 | ransomware_live | — |
| Astac | October 16, 2024 | ransomware_live | — |
| JS McCarthy Printers | October 16, 2024 | ransomware_live | — |
| OzarksGo | October 15, 2024 | ransomware_live | — |
| Concord | October 15, 2024 | ransomware_live | — |
| NatAlliance Securities | October 15, 2024 | ransomware_live | — |
| Henneman Engineering | October 14, 2024 | ransomware_live | — |
| Courtney Construction | October 14, 2024 | ransomware_live | — |
| Mid State Electric | October 14, 2024 | ransomware_live | — |
| Dana Safety Supply | October 14, 2024 | ransomware_live | — |
| The Strainrite Companies | October 11, 2024 | ransomware_live | — |
| Paul White Company | October 11, 2024 | ransomware_live | — |
| CETRULO | October 10, 2024 | ransomware_live | — |
| Maval Industries | October 10, 2024 | ransomware_live | — |
| Saratoga Liquor | October 8, 2024 | ransomware_live | — |
| McCody | October 8, 2024 | ransomware_live | — |
| Sunrise Express | October 8, 2024 | ransomware_live | — |
| Nora Biscuits | October 7, 2024 | ransomware_live | — |
| Absolute Machine Tools | October 7, 2024 | ransomware_live | — |
| Creative Consumer Concepts | October 5, 2024 | ransomware_live | — |
| Eagle Recovery Associates | October 4, 2024 | ransomware_live | — |
| Wilkinson | October 2, 2024 | ransomware_live | — |
| Ivanhoe Club | October 2, 2024 | ransomware_live | — |
| AnVa Industries | October 1, 2024 | ransomware_live | — |
| Byerly Aviation | October 1, 2024 | ransomware_live | — |
| Guerriere & Halnon | September 30, 2024 | ransomware_live | — |
| C&L Ward | September 30, 2024 | ransomware_live | — |
| Andantex USA | September 29, 2024 | ransomware_live | — |
| Performance Food Centers | September 29, 2024 | ransomware_live | — |
| Steel Art Signs | September 26, 2024 | ransomware_live | — |
| Misionero Vegetables | September 26, 2024 | ransomware_live | — |
| Rescar Companies | September 26, 2024 | ransomware_live | — |
| Kuhn and Associates | September 26, 2024 | ransomware_live | — |
| Accounting Resource Group | September 25, 2024 | ransomware_live | — |
| PetEdge | September 24, 2024 | ransomware_live | — |
| Condere Ip, Infracom Group | September 24, 2024 | ransomware_live | — |
| Markdom Plastic Products | September 24, 2024 | ransomware_live | — |
| Pacific Coast Building Products | September 20, 2024 | ransomware_live | — |
| Noble Environmental | September 20, 2024 | ransomware_live | — |
| Messe C | September 20, 2024 | ransomware_live | — |
| Pete's Road Service | September 19, 2024 | ransomware_live | — |
| Classic Business Products | September 18, 2024 | ransomware_live | — |
| Garvey | September 17, 2024 | ransomware_live | — |
| Power Torque Services | September 17, 2024 | ransomware_live | — |
| RobbJack & Crystallume | September 17, 2024 | ransomware_live | — |
| Inktel | September 16, 2024 | ransomware_live | — |
| Protective Industrial Products | September 16, 2024 | ransomware_live | — |
| Reutter | September 16, 2024 | ransomware_live | — |
| Aaren Scientific | September 16, 2024 | ransomware_live | — |
| Universal Companies | September 14, 2024 | ransomware_live | — |
| Jackson Paper Manufacturing | September 13, 2024 | ransomware_live | — |
| Wilmington Convention Center | September 13, 2024 | ransomware_live | — |
| FortyEighty Architecture | September 12, 2024 | ransomware_live | — |
| Dome Construction | September 12, 2024 | ransomware_live | — |
| Affirm Agency | September 11, 2024 | ransomware_live | — |
| Paragon Plastics | September 11, 2024 | ransomware_live | — |
| Virginia Dare Extract Co. | September 10, 2024 | ransomware_live | — |
| Hariri Pontarini Architects | September 10, 2024 | ransomware_live | — |
| 4B Components | September 10, 2024 | ransomware_live | — |
| Rsp | September 9, 2024 | ransomware_live | — |
| Eurobulk | September 9, 2024 | ransomware_live | — |
| Dimensional Merchandising | September 7, 2024 | ransomware_live | — |
| Evans Distribution Systems | September 5, 2024 | ransomware_live | — |
| Creative Playthings | September 5, 2024 | ransomware_live | — |
| Joe Swartz Electric | September 4, 2024 | ransomware_live | — |
| PIGGLY WIGGLY ALABAMA DISTRIBUTING | September 4, 2024 | ransomware_live | — |
| Baskervill | September 4, 2024 | ransomware_live | — |
| Weldco-Beales Manufacturing | September 3, 2024 | ransomware_live | — |
| InteriorWorx Commercial Flooring | September 3, 2024 | ransomware_live | — |
| Thompson Construction Supply | August 31, 2024 | ransomware_live | — |
| Bakersfield | August 30, 2024 | ransomware_live | — |
| Farmers' Rice Cooperative | August 30, 2024 | ransomware_live | — |
| Southeast Cooler | August 28, 2024 | ransomware_live | — |
| Bel-Air Bay Club | August 28, 2024 | ransomware_live | — |
| Multidata | August 28, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).