play
First seen November 26, 2022Active1,308 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Legislative Bill Drafting Commission | April 15, 2024 | ransomware_live | — |
| Profile Products | April 13, 2024 | ransomware_live | — |
| H??????? C?????????? | April 12, 2024 | ransomware_live | — |
| Agate Construction | April 12, 2024 | ransomware_live | — |
| Engineered Automation of Maine | April 12, 2024 | ransomware_live | — |
| Alltruck Bodies | April 12, 2024 | ransomware_live | — |
| New Hudson Facades | April 12, 2024 | ransomware_live | — |
| Starostwo Powiatowe w Świebodzinie | April 11, 2024 | ransomware_live | — |
| F???s???? & ??????t | April 10, 2024 | ransomware_live | — |
| KC Scout | April 10, 2024 | ransomware_live | — |
| JE Owens | April 9, 2024 | ransomware_live | — |
| Theatrixx Technologies | April 6, 2024 | ransomware_live | — |
| Diverse Technology Industrial | April 6, 2024 | ransomware_live | — |
| MoldTech | April 5, 2024 | ransomware_live | — |
| New England Wooden Ware | April 2, 2024 | ransomware_live | — |
| Access Intelligence | April 1, 2024 | ransomware_live | — |
| W?????? ????????y | March 29, 2024 | ransomware_live | — |
| SIS Automatisering | March 28, 2024 | ransomware_live | — |
| Anchorage Daily News | March 28, 2024 | ransomware_live | — |
| Frawner | March 27, 2024 | ransomware_live | — |
| West Monroe | March 27, 2024 | ransomware_live | — |
| Weld Plus | March 27, 2024 | ransomware_live | — |
| Tbr Kowalczyk | March 27, 2024 | ransomware_live | — |
| Sit | March 27, 2024 | ransomware_live | — |
| The MBTW Group | March 27, 2024 | ransomware_live | — |
| LS Networks | March 26, 2024 | ransomware_live | — |
| Pennsylvania Convention Center | March 26, 2024 | ransomware_live | — |
| Advanced Business Networks | March 25, 2024 | ransomware_live | — |
| Feldstein & Stewart | March 23, 2024 | ransomware_live | — |
| Everbrite | March 22, 2024 | ransomware_live | — |
| Heritage Cooperative | March 22, 2024 | ransomware_live | — |
| Wyoming Machinery | March 21, 2024 | ransomware_live | — |
| Guy's Floor Service | March 18, 2024 | ransomware_live | — |
| JM Thompson | March 14, 2024 | ransomware_live | — |
| High Performance Services | March 12, 2024 | ransomware_live | — |
| Q?? ??o?? | March 11, 2024 | ransomware_live | — |
| Ruda Auto | March 11, 2024 | ransomware_live | — |
| White Oak Partners | March 11, 2024 | ransomware_live | — |
| Zips Car Wash | March 11, 2024 | ransomware_live | — |
| Stainless Foundry & Engineering | March 11, 2024 | ransomware_live | — |
| Hartz | March 7, 2024 | ransomware_live | — |
| K???o??? | March 6, 2024 | ransomware_live | — |
| C?????????? A???????e T??????????? | March 6, 2024 | ransomware_live | — |
| MainVest | March 6, 2024 | ransomware_live | — |
| Boingo Graphics | March 6, 2024 | ransomware_live | — |
| Affordable Payroll & Bookkeeping Services | March 6, 2024 | ransomware_live | — |
| Donco Air | March 6, 2024 | ransomware_live | — |
| Levin Porter Associates | March 6, 2024 | ransomware_live | — |
| Tri-state General Contractors | March 6, 2024 | ransomware_live | — |
| Western Mechanical | March 6, 2024 | ransomware_live | — |
| Air International Thermal Systems | March 6, 2024 | ransomware_live | — |
| RCG | March 6, 2024 | ransomware_live | — |
| Precom | March 6, 2024 | ransomware_live | — |
| The Rubber Resources | March 6, 2024 | ransomware_live | — |
| Nor-Well | March 6, 2024 | ransomware_live | — |
| CMD | March 6, 2024 | ransomware_live | — |
| Artemis Holding | March 6, 2024 | ransomware_live | — |
| Fastighetsservice AB | March 6, 2024 | ransomware_live | — |
| Backes | March 6, 2024 | ransomware_live | — |
| Q railing | March 6, 2024 | ransomware_live | — |
| Miller Boskus Lack Architects | March 6, 2024 | ransomware_live | — |
| National Steel City | March 6, 2024 | ransomware_live | — |
| Tri-Point Solutions | March 6, 2024 | ransomware_live | — |
| Budget Electric | March 6, 2024 | ransomware_live | — |
| EIA Global | March 6, 2024 | ransomware_live | — |
| Morrison Companies | March 6, 2024 | ransomware_live | — |
| HD Media Systems | March 6, 2024 | ransomware_live | — |
| Crestone Group | March 6, 2024 | ransomware_live | — |
| Takeuchi US | March 6, 2024 | ransomware_live | — |
| Waterborne Environmental | March 6, 2024 | ransomware_live | — |
| Koch & White Heating & Cooling | March 6, 2024 | ransomware_live | — |
| Jean-Georges | March 6, 2024 | ransomware_live | — |
| ADC Aerospace | March 6, 2024 | ransomware_live | — |
| Infinite Computing Systems | March 6, 2024 | ransomware_live | — |
| Autohaus Pichel GmbH | March 6, 2024 | ransomware_live | — |
| Cemtech | March 6, 2024 | ransomware_live | — |
| Serrano Industries | March 6, 2024 | ransomware_live | — |
| Executive Aviation | March 6, 2024 | ransomware_live | — |
| Capital Wholesale Drug | March 6, 2024 | ransomware_live | — |
| Lucky Look | March 6, 2024 | ransomware_live | — |
| Colorado Construction | March 6, 2024 | ransomware_live | — |
| DURAND-WAYLAND | March 6, 2024 | ransomware_live | — |
| ACC Construction | March 6, 2024 | ransomware_live | — |
| Zuther Hautmann | March 6, 2024 | ransomware_live | — |
| Tax MT | March 6, 2024 | ransomware_live | — |
| The DeBruler | March 6, 2024 | ransomware_live | — |
| Lambda Energy Resources | March 5, 2024 | ransomware_live | — |
| Quality Enclosures | March 5, 2024 | ransomware_live | — |
| Pavilion Construction | March 4, 2024 | ransomware_live | — |
| New Bedford Welding Supply | March 1, 2024 | ransomware_live | — |
| Stack Infrastructure | March 1, 2024 | ransomware_live | — |
| Bechtold | March 1, 2024 | ransomware_live | — |
| BiTec | February 29, 2024 | ransomware_live | — |
| Schokinag | February 27, 2024 | ransomware_live | — |
| Bridger Insurance | February 26, 2024 | ransomware_live | — |
| W???h? | February 22, 2024 | ransomware_live | — |
| Grassmid Transport | February 22, 2024 | ransomware_live | — |
| SREE Hotels | February 21, 2024 | ransomware_live | — |
| Image Pointe | February 21, 2024 | ransomware_live | — |
| QEO Group | February 21, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).