play
First seen November 26, 2022Active1,308 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| C & C Industries | October 16, 2024 | ransomware_live | — |
| Astac | October 16, 2024 | ransomware_live | — |
| JS McCarthy Printers | October 16, 2024 | ransomware_live | — |
| OzarksGo | October 15, 2024 | ransomware_live | — |
| Concord | October 15, 2024 | ransomware_live | — |
| NatAlliance Securities | October 15, 2024 | ransomware_live | — |
| Henneman Engineering | October 14, 2024 | ransomware_live | — |
| Courtney Construction | October 14, 2024 | ransomware_live | — |
| Mid State Electric | October 14, 2024 | ransomware_live | — |
| Dana Safety Supply | October 14, 2024 | ransomware_live | — |
| The Strainrite Companies | October 11, 2024 | ransomware_live | — |
| Paul White Company | October 11, 2024 | ransomware_live | — |
| CETRULO | October 10, 2024 | ransomware_live | — |
| Maval Industries | October 10, 2024 | ransomware_live | — |
| Saratoga Liquor | October 8, 2024 | ransomware_live | — |
| McCody | October 8, 2024 | ransomware_live | — |
| Sunrise Express | October 8, 2024 | ransomware_live | — |
| Nora Biscuits | October 7, 2024 | ransomware_live | — |
| Absolute Machine Tools | October 7, 2024 | ransomware_live | — |
| Creative Consumer Concepts | October 5, 2024 | ransomware_live | — |
| Eagle Recovery Associates | October 4, 2024 | ransomware_live | — |
| Wilkinson | October 2, 2024 | ransomware_live | — |
| Ivanhoe Club | October 2, 2024 | ransomware_live | — |
| AnVa Industries | October 1, 2024 | ransomware_live | — |
| Byerly Aviation | October 1, 2024 | ransomware_live | — |
| Guerriere & Halnon | September 30, 2024 | ransomware_live | — |
| C&L Ward | September 30, 2024 | ransomware_live | — |
| Andantex USA | September 29, 2024 | ransomware_live | — |
| Performance Food Centers | September 29, 2024 | ransomware_live | — |
| Steel Art Signs | September 26, 2024 | ransomware_live | — |
| Misionero Vegetables | September 26, 2024 | ransomware_live | — |
| Rescar Companies | September 26, 2024 | ransomware_live | — |
| Kuhn and Associates | September 26, 2024 | ransomware_live | — |
| Accounting Resource Group | September 25, 2024 | ransomware_live | — |
| PetEdge | September 24, 2024 | ransomware_live | — |
| Condere Ip, Infracom Group | September 24, 2024 | ransomware_live | — |
| Markdom Plastic Products | September 24, 2024 | ransomware_live | — |
| Pacific Coast Building Products | September 20, 2024 | ransomware_live | — |
| Noble Environmental | September 20, 2024 | ransomware_live | — |
| Messe C | September 20, 2024 | ransomware_live | — |
| Pete's Road Service | September 19, 2024 | ransomware_live | — |
| Classic Business Products | September 18, 2024 | ransomware_live | — |
| Garvey | September 17, 2024 | ransomware_live | — |
| Power Torque Services | September 17, 2024 | ransomware_live | — |
| RobbJack & Crystallume | September 17, 2024 | ransomware_live | — |
| Inktel | September 16, 2024 | ransomware_live | — |
| Protective Industrial Products | September 16, 2024 | ransomware_live | — |
| Reutter | September 16, 2024 | ransomware_live | — |
| Aaren Scientific | September 16, 2024 | ransomware_live | — |
| Universal Companies | September 14, 2024 | ransomware_live | — |
| Jackson Paper Manufacturing | September 13, 2024 | ransomware_live | — |
| Wilmington Convention Center | September 13, 2024 | ransomware_live | — |
| FortyEighty Architecture | September 12, 2024 | ransomware_live | — |
| Dome Construction | September 12, 2024 | ransomware_live | — |
| Affirm Agency | September 11, 2024 | ransomware_live | — |
| Paragon Plastics | September 11, 2024 | ransomware_live | — |
| Virginia Dare Extract Co. | September 10, 2024 | ransomware_live | — |
| Hariri Pontarini Architects | September 10, 2024 | ransomware_live | — |
| 4B Components | September 10, 2024 | ransomware_live | — |
| Rsp | September 9, 2024 | ransomware_live | — |
| Eurobulk | September 9, 2024 | ransomware_live | — |
| Dimensional Merchandising | September 7, 2024 | ransomware_live | — |
| Evans Distribution Systems | September 5, 2024 | ransomware_live | — |
| Creative Playthings | September 5, 2024 | ransomware_live | — |
| Joe Swartz Electric | September 4, 2024 | ransomware_live | — |
| PIGGLY WIGGLY ALABAMA DISTRIBUTING | September 4, 2024 | ransomware_live | — |
| Baskervill | September 4, 2024 | ransomware_live | — |
| Weldco-Beales Manufacturing | September 3, 2024 | ransomware_live | — |
| InteriorWorx Commercial Flooring | September 3, 2024 | ransomware_live | — |
| Thompson Construction Supply | August 31, 2024 | ransomware_live | — |
| Bakersfield | August 30, 2024 | ransomware_live | — |
| Farmers' Rice Cooperative | August 30, 2024 | ransomware_live | — |
| Southeast Cooler | August 28, 2024 | ransomware_live | — |
| Bel-Air Bay Club | August 28, 2024 | ransomware_live | — |
| Multidata | August 28, 2024 | ransomware_live | — |
| Elgin Separation Solutions | August 27, 2024 | ransomware_live | — |
| Microchip Technology | August 26, 2024 | ransomware_live | — |
| Crain Group | August 26, 2024 | ransomware_live | — |
| Mile Hi Foods | August 24, 2024 | ransomware_live | — |
| G/S Solutions | August 23, 2024 | ransomware_live | — |
| Quilvest Capital Partners | August 21, 2024 | ransomware_live | — |
| Grid Subject Matter Experts | August 21, 2024 | ransomware_live | — |
| Software Engineering Associates | August 21, 2024 | ransomware_live | — |
| Epi Breads | August 21, 2024 | ransomware_live | — |
| Plaisted Companies | August 21, 2024 | ransomware_live | — |
| Seirus Innovation | August 20, 2024 | ransomware_live | — |
| Universal Pure | August 19, 2024 | ransomware_live | — |
| Omega Industries | August 19, 2024 | ransomware_live | — |
| BroadGrain Commodities | August 19, 2024 | ransomware_live | — |
| Smoker's Choice | August 17, 2024 | ransomware_live | — |
| The SMS Group | August 16, 2024 | ransomware_live | — |
| Armour Coatings | August 15, 2024 | ransomware_live | — |
| M??? ????k ?????? | August 13, 2024 | ransomware_live | — |
| Parker Development Company | August 9, 2024 | ransomware_live | — |
| Adina Design | August 7, 2024 | ransomware_live | — |
| Policy Administration Solutions | August 5, 2024 | ransomware_live | — |
| Mill Creek Lumber | August 3, 2024 | ransomware_live | — |
| TelPro | August 2, 2024 | ransomware_live | — |
| KinetX | August 1, 2024 | ransomware_live | — |
| ABC Parts International | August 1, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).