play
First seen November 26, 2022Active1,342 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Elgin Separation Solutions | August 27, 2024 | ransomware_live | — |
| Microchip Technology | August 26, 2024 | ransomware_live | — |
| Crain Group | August 26, 2024 | ransomware_live | — |
| Mile Hi Foods | August 24, 2024 | ransomware_live | — |
| G/S Solutions | August 23, 2024 | ransomware_live | — |
| Quilvest Capital Partners | August 21, 2024 | ransomware_live | — |
| Grid Subject Matter Experts | August 21, 2024 | ransomware_live | — |
| Software Engineering Associates | August 21, 2024 | ransomware_live | — |
| Epi Breads | August 21, 2024 | ransomware_live | — |
| Plaisted Companies | August 21, 2024 | ransomware_live | — |
| Seirus Innovation | August 20, 2024 | ransomware_live | — |
| Universal Pure | August 19, 2024 | ransomware_live | — |
| Omega Industries | August 19, 2024 | ransomware_live | — |
| BroadGrain Commodities | August 19, 2024 | ransomware_live | — |
| Smoker's Choice | August 17, 2024 | ransomware_live | — |
| The SMS Group | August 16, 2024 | ransomware_live | — |
| Armour Coatings | August 15, 2024 | ransomware_live | — |
| M??? ????k ?????? | August 13, 2024 | ransomware_live | — |
| Parker Development Company | August 9, 2024 | ransomware_live | — |
| Adina Design | August 7, 2024 | ransomware_live | — |
| Policy Administration Solutions | August 5, 2024 | ransomware_live | — |
| Mill Creek Lumber | August 3, 2024 | ransomware_live | — |
| TelPro | August 2, 2024 | ransomware_live | — |
| KinetX | August 1, 2024 | ransomware_live | — |
| ABC Parts International | August 1, 2024 | ransomware_live | — |
| Erie Meats | July 31, 2024 | ransomware_live | — |
| Alternate Energy | July 30, 2024 | ransomware_live | — |
| The Sourcing Group | July 23, 2024 | ransomware_live | — |
| C???o???m | July 17, 2024 | ransomware_live | — |
| Granit Design | July 16, 2024 | ransomware_live | — |
| Lantronix | July 16, 2024 | ransomware_live | — |
| CinemaTech | July 14, 2024 | ransomware_live | — |
| Clabots | July 12, 2024 | ransomware_live | — |
| GDB International | July 12, 2024 | ransomware_live | — |
| Nilorngruppen AB | July 10, 2024 | ransomware_live | — |
| Credible Group | July 9, 2024 | ransomware_live | — |
| True Blue Environmental | July 8, 2024 | ransomware_live | — |
| True Family Enterprises | July 2, 2024 | ransomware_live | — |
| INDA's | June 29, 2024 | ransomware_live | — |
| Texas Recycling | June 29, 2024 | ransomware_live | — |
| Hyperice | June 29, 2024 | ransomware_live | — |
| OfficeOps | June 29, 2024 | ransomware_live | — |
| Odyssey Fitness Center | June 29, 2024 | ransomware_live | — |
| Golden Business Machines | June 29, 2024 | ransomware_live | — |
| Gateway Extrusions | June 29, 2024 | ransomware_live | — |
| The Computer Merchant | June 28, 2024 | ransomware_live | — |
| Congoleum | June 27, 2024 | ransomware_live | — |
| Gendron & Gendron | June 25, 2024 | ransomware_live | — |
| Ladco | June 23, 2024 | ransomware_live | — |
| Texas Electric Cooperatives | June 21, 2024 | ransomware_live | — |
| Hayden Power Group | June 19, 2024 | ransomware_live | — |
| The 21st Century Energy Group | June 18, 2024 | ransomware_live | — |
| Harvey Construction | June 14, 2024 | ransomware_live | — |
| Elyria Foundry | June 13, 2024 | ransomware_live | — |
| Smartweb | June 12, 2024 | ransomware_live | — |
| Trisun Land Services | June 12, 2024 | ransomware_live | — |
| ANTECH-GUTLING Gruppe | June 12, 2024 | ransomware_live | — |
| Walder Wyss and Partners | June 12, 2024 | ransomware_live | — |
| TPI | June 11, 2024 | ransomware_live | — |
| T P C I | June 11, 2024 | ransomware_live | — |
| Belle Tire | June 10, 2024 | ransomware_live | — |
| Prairie Athletic Club | June 10, 2024 | ransomware_live | — |
| MIPS Technologies | June 10, 2024 | ransomware_live | — |
| Hedrick Brothers Construction | June 8, 2024 | ransomware_live | — |
| Bunger Steel | June 7, 2024 | ransomware_live | — |
| World inquest | June 7, 2024 | ransomware_live | — |
| Omicron Granite & Tile | June 7, 2024 | ransomware_live | — |
| RRCA Accounts Management | June 6, 2024 | ransomware_live | — |
| Williams Construction | June 6, 2024 | ransomware_live | — |
| FPL Food | May 30, 2024 | ransomware_live | — |
| Goodman Reichwald-Dodge | May 30, 2024 | ransomware_live | — |
| Credit Central | May 29, 2024 | ransomware_live | — |
| Custom Concrete | May 29, 2024 | ransomware_live | — |
| ProMotion Holdings | May 28, 2024 | ransomware_live | — |
| Brainworks Software | May 24, 2024 | ransomware_live | — |
| Eagle Materials | May 23, 2024 | ransomware_live | — |
| Aldenhoven | May 23, 2024 | ransomware_live | — |
| Innerspec Technologies | May 23, 2024 | ransomware_live | — |
| Experis Technology Group | May 22, 2024 | ransomware_live | — |
| Me Too Shoes | May 22, 2024 | ransomware_live | — |
| Johnston | May 22, 2024 | ransomware_live | — |
| Great Lakes International Trading | May 20, 2024 | ransomware_live | — |
| Chroma Color | May 17, 2024 | ransomware_live | — |
| 3GL Technology Solutions | May 17, 2024 | ransomware_live | — |
| Shinnick & Ryan | May 16, 2024 | ransomware_live | — |
| Peterbilt of Atlanta | May 16, 2024 | ransomware_live | — |
| Amarilla Gas | May 14, 2024 | ransomware_live | — |
| Kinter | May 13, 2024 | ransomware_live | — |
| Haumiller Engineering | May 10, 2024 | ransomware_live | — |
| Ntv | May 10, 2024 | ransomware_live | — |
| Celluphone | May 10, 2024 | ransomware_live | — |
| Elmhurst Group | May 9, 2024 | ransomware_live | — |
| Aspire Tax | May 7, 2024 | ransomware_live | — |
| Ryder Scott Co. | May 7, 2024 | ransomware_live | — |
| Ab Monsteras Metall | May 7, 2024 | ransomware_live | — |
| Southern Specialty & Supply | May 7, 2024 | ransomware_live | — |
| Refcio & Associates | May 5, 2024 | ransomware_live | — |
| Semicore Equipment | May 3, 2024 | ransomware_live | — |
| WALSER AUTOMOTIVE GROUP | May 3, 2024 | ransomware_live | — |
| City Builders | May 2, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).