Ransomware Group intelligence

Play

Active

Track Play with 1297 published victims and 4 known leak locations in a single intelligence view.

Victims 1297 Known published victims in this dataset
First discovered 2022-11-26 Earliest victim discovery date
Last discovered 2026-07-16 Latest victim discovery date
Inactive since 2 days Days since the latest known victim
Top country United States 929 victims
Known locations 4 Leak or negotiation infrastructure tracked

Overview

Play is tracked by Breach House as a ransomware group with 1297 published victims.

United States is currently the most targeted country in this dataset.

4 known leak locations are currently associated with this group.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (4)

    Label Type Availability Links
    Leak location 1 Onion service Unknown mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion
    Leak location 2 Onion service Unknown k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion
    Leak location 3 Onion service Unknown mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion
    Leak location 4 Onion service Unknown j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion

    Top Activity Sectors

    No sector intelligence available.

    Research Sources

    No external research sources linked yet.

    Victims (1297)

    Search, filter and paginate the victim timeline for Play. Showing 1201–1297 of 1297.

    Type Target Discovered Country Business Category Intel Link
    Ransomware Corrib Oil id6163 View details Ireland Energy —
    Ransomware Structab AB (MegTax) id6162 View details Sweden Other —
    Ransomware CH Media id6107 View details Switzerland Communication / Marketing —
    Ransomware PESA Bydgoszcz id6103 View details Poland Other —
    Ransomware Palo Alto County Sheriff id6058 View details United States Public Sector
    Ransomware PKF Antares id6057 View details Canada Other
    Ransomware Legion Aero id6056 View details United States Public Sector
    Ransomware Vleeswarenfabriek Jac Michiels id6055 View details Belgium Other
    Ransomware Schirm id6054 View details Germany Other
    Ransomware BMW France id5947 View details France Other
    Ransomware Oscar Software id5946 View details Finland IT
    Ransomware Jablite id5945 View details United Kingdom Other
    Ransomware Lightcast id5921 View details Other
    Ransomware Optica id5920 View details United States Public Sector
    Ransomware James, McElroy and Diehl id5919 View details United States Finance / Legal / Insurance —
    Ransomware Lysander Associates id5918 View details United Kingdom Other
    Ransomware TAC id5917 View details Austria Other
    Ransomware Guyana Goldfields id5916 View details Canada Other
    Ransomware Picou Builders Supply id5915 View details United States Public Sector
    Ransomware Kk Mehta Cpa Associates id5914 View details United States Public Sector
    Ransomware Pizza 73 id5913 View details Canada Other
    Ransomware Stanley Steemer id5765 View details United States Public Sector
    Ransomware A&T group of companies id5764 View details Poland Services
    Ransomware Berga Recycling id5763 View details Canada Other
    Ransomware Pine Tree Commercial Realty id5762 View details United States Public Sector
    Ransomware Norman Shutters id5761 View details United States Public Sector
    Ransomware TaxAssist Accountants id5760 View details United Kingdom Other
    Ransomware draftPros id5759 View details United States Communication / Marketing
    Ransomware Royal Dirkzwager id5695 View details Netherlands Other
    Ransomware Real Pro id5677 View details United States Communication / Marketing
    Ransomware Leemock id5676 View details United States Public Sector
    Ransomware The M. K. Morse id5675 View details United States Public Sector
    Ransomware Secure Wrap id5674 View details United States Public Sector
    Ransomware Russell Finex id5673 View details United Kingdom Other
    Ransomware Oakland id5564 View details United States Public Sector —
    Ransomware O???a?? id5559 View details Other —
    Ransomware InPro electric id5520 View details Germany Communication / Marketing —
    Ransomware I???o e???t??? id5498 View details Germany Other —
    Ransomware Microgame SpA id5446 View details Italy Other —
    Ransomware Energie Pool Schweiz id5445 View details Switzerland Other —
    Ransomware M???????? S?? id5393 View details Other —
    Ransomware A10 id5388 View details United States Telecommunications —
    Ransomware Cave Beblenheim id5387 View details Other —
    Ransomware ACS id5386 View details Other —
    Ransomware L?? C??e id5379 View details Other —
    Ransomware ?C? id5378 View details Other —
    Ransomware Point Dedicated Services id5357 View details Services —
    Ransomware Helicar id5298 View details Other —
    Ransomware ADMIRAL Sportwetten id5291 View details Austria Other —
    Ransomware A?????L S?????????? ???? id5283 View details Austria Other —
    Ransomware Arnold Clark id5251 View details Other —
    Ransomware DAYTON PROGRESS id5250 View details Communication / Marketing —
    Ransomware D???? P??????s id5226 View details United Kingdom Other —
    Ransomware A????? ????k id5225 View details United Kingdom Other —
    Ransomware Tarntank Ship Management id5189 View details Services —
    Ransomware Sirius Shipping id5187 View details Transportation / Travel / Logistics —
    Ransomware SUNY Polytechnic Institute id5186 View details Education —
    Ransomware Furetank id5185 View details Sweden Other —
    Ransomware Stratacache id5184 View details United States Public Sector —
    Ransomware S??? id5183 View details Other —
    Ransomware CDER id5182 View details France Other —
    Ransomware FURETANK,SIRIUS SHIPPING,VAS,DONSONET id5138 View details Sweden Transportation / Travel / Logistics —
    Ransomware Cervecería Regional id4955 View details Venezuela, Bolivarian Republic of Other —
    Ransomware F???????, ???, D????????, T???????, S????????????? id4954 View details Other —
    Ransomware OPUS IT Services id4891 View details Services —
    Ransomware H-Hotels id4890 View details Hospitality / Food & Beverage / Tourism —
    Ransomware C???e????? ????????????? id4889 View details Other —
    Ransomware Creta Farm id4888 View details Greece Agriculture / Food —
    Ransomware S?????????? id4886 View details Other —
    Ransomware Arsat id4882 View details Other —
    Ransomware JMicron id4881 View details Other —
    Ransomware VFS id4838 View details Other —
    Ransomware Cetrogar id4837 View details Other —
    Ransomware Una Seguros id4822 View details Other —
    Ransomware Antwerpen id4821 View details Other —
    Ransomware ??????? id4760 View details Other —
    Ransomware Hilldrup id4759 View details Other —
    Ransomware ???? id4757 View details Other —
    Ransomware Skoda Praha id4754 View details Communication / Marketing —
    Ransomware MME Group id4753 View details Services —
    Ransomware Highwater Ethanol id4752 View details Other —
    Ransomware Wrota Mazowsza id4751 View details Other —
    Ransomware UJV Rez id4750 View details Other —
    Ransomware ????????? ???? ????? id4749 View details Other —
    Ransomware CIBTvisas id4743 View details Other —
    Ransomware Austria Presse Agentur id4717 View details Communication / Marketing —
    Ransomware ??? id4686 View details Other —
    Ransomware Verity cloud id4682 View details IT —
    Ransomware ??????????? id4681 View details Other —
    Ransomware ???? ????? id4680 View details Other —
    Ransomware PVFCCo id4669 View details Other —
    Ransomware Leadtek id4668 View details Other —
    Ransomware Alcomet id4667 View details Other —
    Ransomware Ministry of Transport and Public Works id4666 View details Public Sector —
    Ransomware Itsgroup id4665 View details Services —
    Ransomware Conseil departemental - Alpes-Maritimes id4664 View details Other —
    Ransomware Origin Property Company Limited id4663 View details Construction / Real Estate —