play
First seen November 26, 2022Active1,308 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Erie Meats | July 31, 2024 | ransomware_live | — |
| Alternate Energy | July 30, 2024 | ransomware_live | — |
| The Sourcing Group | July 23, 2024 | ransomware_live | — |
| C???o???m | July 17, 2024 | ransomware_live | — |
| Granit Design | July 16, 2024 | ransomware_live | — |
| Lantronix | July 16, 2024 | ransomware_live | — |
| CinemaTech | July 14, 2024 | ransomware_live | — |
| Clabots | July 12, 2024 | ransomware_live | — |
| GDB International | July 12, 2024 | ransomware_live | — |
| Nilorngruppen AB | July 10, 2024 | ransomware_live | — |
| Credible Group | July 9, 2024 | ransomware_live | — |
| True Blue Environmental | July 8, 2024 | ransomware_live | — |
| True Family Enterprises | July 2, 2024 | ransomware_live | — |
| INDA's | June 29, 2024 | ransomware_live | — |
| Texas Recycling | June 29, 2024 | ransomware_live | — |
| Hyperice | June 29, 2024 | ransomware_live | — |
| OfficeOps | June 29, 2024 | ransomware_live | — |
| Odyssey Fitness Center | June 29, 2024 | ransomware_live | — |
| Golden Business Machines | June 29, 2024 | ransomware_live | — |
| Gateway Extrusions | June 29, 2024 | ransomware_live | — |
| The Computer Merchant | June 28, 2024 | ransomware_live | — |
| Congoleum | June 27, 2024 | ransomware_live | — |
| Gendron & Gendron | June 25, 2024 | ransomware_live | — |
| Ladco | June 23, 2024 | ransomware_live | — |
| Texas Electric Cooperatives | June 21, 2024 | ransomware_live | — |
| Hayden Power Group | June 19, 2024 | ransomware_live | — |
| The 21st Century Energy Group | June 18, 2024 | ransomware_live | — |
| Harvey Construction | June 14, 2024 | ransomware_live | — |
| Elyria Foundry | June 13, 2024 | ransomware_live | — |
| Smartweb | June 12, 2024 | ransomware_live | — |
| Trisun Land Services | June 12, 2024 | ransomware_live | — |
| ANTECH-GUTLING Gruppe | June 12, 2024 | ransomware_live | — |
| Walder Wyss and Partners | June 12, 2024 | ransomware_live | — |
| TPI | June 11, 2024 | ransomware_live | — |
| T P C I | June 11, 2024 | ransomware_live | — |
| Belle Tire | June 10, 2024 | ransomware_live | — |
| Prairie Athletic Club | June 10, 2024 | ransomware_live | — |
| MIPS Technologies | June 10, 2024 | ransomware_live | — |
| Hedrick Brothers Construction | June 8, 2024 | ransomware_live | — |
| Bunger Steel | June 7, 2024 | ransomware_live | — |
| World inquest | June 7, 2024 | ransomware_live | — |
| Omicron Granite & Tile | June 7, 2024 | ransomware_live | — |
| RRCA Accounts Management | June 6, 2024 | ransomware_live | — |
| Williams Construction | June 6, 2024 | ransomware_live | — |
| FPL Food | May 30, 2024 | ransomware_live | — |
| Goodman Reichwald-Dodge | May 30, 2024 | ransomware_live | — |
| Credit Central | May 29, 2024 | ransomware_live | — |
| Custom Concrete | May 29, 2024 | ransomware_live | — |
| ProMotion Holdings | May 28, 2024 | ransomware_live | — |
| Brainworks Software | May 24, 2024 | ransomware_live | — |
| Eagle Materials | May 23, 2024 | ransomware_live | — |
| Aldenhoven | May 23, 2024 | ransomware_live | — |
| Innerspec Technologies | May 23, 2024 | ransomware_live | — |
| Experis Technology Group | May 22, 2024 | ransomware_live | — |
| Me Too Shoes | May 22, 2024 | ransomware_live | — |
| Johnston | May 22, 2024 | ransomware_live | — |
| Great Lakes International Trading | May 20, 2024 | ransomware_live | — |
| Chroma Color | May 17, 2024 | ransomware_live | — |
| 3GL Technology Solutions | May 17, 2024 | ransomware_live | — |
| Shinnick & Ryan | May 16, 2024 | ransomware_live | — |
| Peterbilt of Atlanta | May 16, 2024 | ransomware_live | — |
| Amarilla Gas | May 14, 2024 | ransomware_live | — |
| Kinter | May 13, 2024 | ransomware_live | — |
| Haumiller Engineering | May 10, 2024 | ransomware_live | — |
| Ntv | May 10, 2024 | ransomware_live | — |
| Celluphone | May 10, 2024 | ransomware_live | — |
| Elmhurst Group | May 9, 2024 | ransomware_live | — |
| Aspire Tax | May 7, 2024 | ransomware_live | — |
| Ryder Scott Co. | May 7, 2024 | ransomware_live | — |
| Ab Monsteras Metall | May 7, 2024 | ransomware_live | — |
| Southern Specialty & Supply | May 7, 2024 | ransomware_live | — |
| Refcio & Associates | May 5, 2024 | ransomware_live | — |
| Semicore Equipment | May 3, 2024 | ransomware_live | — |
| WALSER AUTOMOTIVE GROUP | May 3, 2024 | ransomware_live | — |
| City Builders | May 2, 2024 | ransomware_live | — |
| NK Parts Industries | May 1, 2024 | ransomware_live | — |
| Ardenbrook | May 1, 2024 | ransomware_live | — |
| C?????l I????????s | April 30, 2024 | ransomware_live | — |
| Central Florida Equipment | April 30, 2024 | ransomware_live | — |
| The Louis G Freeman | April 29, 2024 | ransomware_live | — |
| LiveHelpNow | April 27, 2024 | ransomware_live | — |
| Toolmarts | April 26, 2024 | ransomware_live | — |
| Madata | April 26, 2024 | ransomware_live | — |
| Somerville | April 26, 2024 | ransomware_live | — |
| Badger Tag & Label | April 25, 2024 | ransomware_live | — |
| Visa Lighting | April 25, 2024 | ransomware_live | — |
| Seagulf Marine Industries | April 25, 2024 | ransomware_live | — |
| Utica Mack | April 24, 2024 | ransomware_live | — |
| Sentry Data Management | April 23, 2024 | ransomware_live | — |
| Air Cleaning Specialists | April 23, 2024 | ransomware_live | — |
| UniTrak | April 23, 2024 | ransomware_live | — |
| P??????? & ???? | April 19, 2024 | ransomware_live | — |
| Yale Mortgage | April 19, 2024 | ransomware_live | — |
| Corbin Turf & Ornamental Supply | April 19, 2024 | ransomware_live | — |
| Precision Fluid Controls | April 18, 2024 | ransomware_live | — |
| Axip Energy Services | April 18, 2024 | ransomware_live | — |
| RDI-USA | April 18, 2024 | ransomware_live | — |
| Original Herkimer Cheese | April 17, 2024 | ransomware_live | — |
| Mauritzon | April 17, 2024 | ransomware_live | — |
| Canatal Industries | April 16, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).