play
First seen November 26, 2022Active1,342 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| NK Parts Industries | May 1, 2024 | ransomware_live | — |
| Ardenbrook | May 1, 2024 | ransomware_live | — |
| C?????l I????????s | April 30, 2024 | ransomware_live | — |
| Central Florida Equipment | April 30, 2024 | ransomware_live | — |
| The Louis G Freeman | April 29, 2024 | ransomware_live | — |
| LiveHelpNow | April 27, 2024 | ransomware_live | — |
| Toolmarts | April 26, 2024 | ransomware_live | — |
| Madata | April 26, 2024 | ransomware_live | — |
| Somerville | April 26, 2024 | ransomware_live | — |
| Badger Tag & Label | April 25, 2024 | ransomware_live | — |
| Visa Lighting | April 25, 2024 | ransomware_live | — |
| Seagulf Marine Industries | April 25, 2024 | ransomware_live | — |
| Utica Mack | April 24, 2024 | ransomware_live | — |
| Sentry Data Management | April 23, 2024 | ransomware_live | — |
| Air Cleaning Specialists | April 23, 2024 | ransomware_live | — |
| UniTrak | April 23, 2024 | ransomware_live | — |
| P??????? & ???? | April 19, 2024 | ransomware_live | — |
| Yale Mortgage | April 19, 2024 | ransomware_live | — |
| Corbin Turf & Ornamental Supply | April 19, 2024 | ransomware_live | — |
| Precision Fluid Controls | April 18, 2024 | ransomware_live | — |
| Axip Energy Services | April 18, 2024 | ransomware_live | — |
| RDI-USA | April 18, 2024 | ransomware_live | — |
| Original Herkimer Cheese | April 17, 2024 | ransomware_live | — |
| Mauritzon | April 17, 2024 | ransomware_live | — |
| Canatal Industries | April 16, 2024 | ransomware_live | — |
| Legislative Bill Drafting Commission | April 15, 2024 | ransomware_live | — |
| Profile Products | April 13, 2024 | ransomware_live | — |
| H??????? C?????????? | April 12, 2024 | ransomware_live | — |
| Agate Construction | April 12, 2024 | ransomware_live | — |
| Engineered Automation of Maine | April 12, 2024 | ransomware_live | — |
| Alltruck Bodies | April 12, 2024 | ransomware_live | — |
| New Hudson Facades | April 12, 2024 | ransomware_live | — |
| Starostwo Powiatowe w Świebodzinie | April 11, 2024 | ransomware_live | — |
| F???s???? & ??????t | April 10, 2024 | ransomware_live | — |
| KC Scout | April 10, 2024 | ransomware_live | — |
| JE Owens | April 9, 2024 | ransomware_live | — |
| Theatrixx Technologies | April 6, 2024 | ransomware_live | — |
| Diverse Technology Industrial | April 6, 2024 | ransomware_live | — |
| MoldTech | April 5, 2024 | ransomware_live | — |
| New England Wooden Ware | April 2, 2024 | ransomware_live | — |
| Access Intelligence | April 1, 2024 | ransomware_live | — |
| W?????? ????????y | March 29, 2024 | ransomware_live | — |
| SIS Automatisering | March 28, 2024 | ransomware_live | — |
| Anchorage Daily News | March 28, 2024 | ransomware_live | — |
| Frawner | March 27, 2024 | ransomware_live | — |
| West Monroe | March 27, 2024 | ransomware_live | — |
| Weld Plus | March 27, 2024 | ransomware_live | — |
| Tbr Kowalczyk | March 27, 2024 | ransomware_live | — |
| Sit | March 27, 2024 | ransomware_live | — |
| The MBTW Group | March 27, 2024 | ransomware_live | — |
| LS Networks | March 26, 2024 | ransomware_live | — |
| Pennsylvania Convention Center | March 26, 2024 | ransomware_live | — |
| Advanced Business Networks | March 25, 2024 | ransomware_live | — |
| Feldstein & Stewart | March 23, 2024 | ransomware_live | — |
| Everbrite | March 22, 2024 | ransomware_live | — |
| Heritage Cooperative | March 22, 2024 | ransomware_live | — |
| Wyoming Machinery | March 21, 2024 | ransomware_live | — |
| Guy's Floor Service | March 18, 2024 | ransomware_live | — |
| JM Thompson | March 14, 2024 | ransomware_live | — |
| High Performance Services | March 12, 2024 | ransomware_live | — |
| Q?? ??o?? | March 11, 2024 | ransomware_live | — |
| Ruda Auto | March 11, 2024 | ransomware_live | — |
| White Oak Partners | March 11, 2024 | ransomware_live | — |
| Zips Car Wash | March 11, 2024 | ransomware_live | — |
| Stainless Foundry & Engineering | March 11, 2024 | ransomware_live | — |
| Hartz | March 7, 2024 | ransomware_live | — |
| Southern Concrete Construction | March 6, 2024 | ransomware_live | — |
| Tbr Kowalczyk | March 6, 2024 | ransomware_live | — |
| Arboris | March 6, 2024 | ransomware_live | — |
| Weldco-Beales Manufacturing | March 6, 2024 | ransomware_live | — |
| Orth Automobile | March 6, 2024 | ransomware_live | — |
| First Tek | March 6, 2024 | ransomware_live | — |
| Emtech Inc | March 6, 2024 | ransomware_live | — |
| Marconi Industrial Services | March 6, 2024 | ransomware_live | — |
| Technical Die-Casting | March 6, 2024 | ransomware_live | — |
| K???o??? | March 6, 2024 | ransomware_live | — |
| C?????????? A???????e T??????????? | March 6, 2024 | ransomware_live | — |
| MainVest | March 6, 2024 | ransomware_live | — |
| Boingo Graphics | March 6, 2024 | ransomware_live | — |
| Affordable Payroll & Bookkeeping Services | March 6, 2024 | ransomware_live | — |
| Donco Air | March 6, 2024 | ransomware_live | — |
| Levin Porter Associates | March 6, 2024 | ransomware_live | — |
| Tri-state General Contractors | March 6, 2024 | ransomware_live | — |
| Western Mechanical | March 6, 2024 | ransomware_live | — |
| Air International Thermal Systems | March 6, 2024 | ransomware_live | — |
| RCG | March 6, 2024 | ransomware_live | — |
| Precom | March 6, 2024 | ransomware_live | — |
| The Rubber Resources | March 6, 2024 | ransomware_live | — |
| Nor-Well | March 6, 2024 | ransomware_live | — |
| CMD | March 6, 2024 | ransomware_live | — |
| Artemis Holding | March 6, 2024 | ransomware_live | — |
| Fastighetsservice AB | March 6, 2024 | ransomware_live | — |
| Backes | March 6, 2024 | ransomware_live | — |
| Q railing | March 6, 2024 | ransomware_live | — |
| Miller Boskus Lack Architects | March 6, 2024 | ransomware_live | — |
| National Steel City | March 6, 2024 | ransomware_live | — |
| Tri-Point Solutions | March 6, 2024 | ransomware_live | — |
| Budget Electric | March 6, 2024 | ransomware_live | — |
| EIA Global | March 6, 2024 | ransomware_live | — |
| Morrison Companies | March 6, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).