Ransomware Group intelligence

Play

Active

Track Play with 1309 published victims and 4 known leak locations in a single intelligence view.

Victims 1309 Known published victims in this dataset
First discovered 2022-11-26 Earliest victim discovery date
Last discovered 2026-07-23 Latest victim discovery date
Inactive since 5 days Days since the latest known victim
Top country United States 934 victims
Known locations 4 Leak or negotiation infrastructure tracked

Overview

Play is tracked by Breach House as a ransomware group with 1309 published victims.

United States is currently the most targeted country in this dataset.

4 known leak locations are currently associated with this group.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (4)

    Label Type Availability Links
    Leak location 1 Onion service Unknown mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion
    Leak location 2 Onion service Unknown k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion
    Leak location 3 Onion service Unknown mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion
    Leak location 4 Onion service Unknown j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion

    Top Activity Sectors

    No sector intelligence available.

    Research Sources

    No external research sources linked yet.

    Victims (1309)

    Search, filter and paginate the victim timeline for Play. Showing 1201–1300 of 1309.

    Type Target Discovered Country Business Category Intel Link
    Ransomware City of Lowell id6325 View details United States Public Sector
    Ransomware DGC id6324 View details Sweden Services
    Ransomware Libra Virtua id6323 View details Hungary Communication / Marketing
    Ransomware Commune de Saxon id6322 View details Switzerland Public Sector
    Ransomware Negma Business Solutions id6321 View details United States Services
    Ransomware Vocalcom id6320 View details France IT
    Ransomware Woonkracht10 id6319 View details Netherlands Retail / E-commerce
    Ransomware Groupe Gambetta id6201 View details France Services
    Ransomware UECC id6200 View details Norway Other
    Ransomware Bang IT Solutions id6166 View details Australia Services —
    Ransomware Huissiers id6165 View details France Other
    Ransomware Coldiretti id6164 View details Italy Other —
    Ransomware Corrib Oil id6163 View details Ireland Energy —
    Ransomware Structab AB (MegTax) id6162 View details Sweden Other —
    Ransomware CH Media id6107 View details Switzerland Communication / Marketing —
    Ransomware PESA Bydgoszcz id6103 View details Poland Other —
    Ransomware Palo Alto County Sheriff id6058 View details United States Public Sector
    Ransomware PKF Antares id6057 View details Canada Other
    Ransomware Legion Aero id6056 View details United States Public Sector
    Ransomware Vleeswarenfabriek Jac Michiels id6055 View details Belgium Other
    Ransomware Schirm id6054 View details Germany Other
    Ransomware BMW France id5947 View details France Other
    Ransomware Oscar Software id5946 View details Finland IT
    Ransomware Jablite id5945 View details United Kingdom Other
    Ransomware Lightcast id5921 View details Other
    Ransomware Optica id5920 View details United States Public Sector
    Ransomware James, McElroy and Diehl id5919 View details United States Finance / Legal / Insurance —
    Ransomware Lysander Associates id5918 View details United Kingdom Other
    Ransomware TAC id5917 View details Austria Other
    Ransomware Guyana Goldfields id5916 View details Canada Other
    Ransomware Picou Builders Supply id5915 View details United States Public Sector
    Ransomware Kk Mehta Cpa Associates id5914 View details United States Public Sector
    Ransomware Pizza 73 id5913 View details Canada Other
    Ransomware Stanley Steemer id5765 View details United States Public Sector
    Ransomware A&T group of companies id5764 View details Poland Services
    Ransomware Berga Recycling id5763 View details Canada Other
    Ransomware Pine Tree Commercial Realty id5762 View details United States Public Sector
    Ransomware Norman Shutters id5761 View details United States Public Sector
    Ransomware TaxAssist Accountants id5760 View details United Kingdom Other
    Ransomware draftPros id5759 View details United States Communication / Marketing
    Ransomware Royal Dirkzwager id5695 View details Netherlands Other
    Ransomware Real Pro id5677 View details United States Communication / Marketing
    Ransomware Leemock id5676 View details United States Public Sector
    Ransomware The M. K. Morse id5675 View details United States Public Sector
    Ransomware Secure Wrap id5674 View details United States Public Sector
    Ransomware Russell Finex id5673 View details United Kingdom Other
    Ransomware Oakland id5564 View details United States Public Sector —
    Ransomware O???a?? id5559 View details Other —
    Ransomware InPro electric id5520 View details Germany Communication / Marketing —
    Ransomware I???o e???t??? id5498 View details Germany Other —
    Ransomware Microgame SpA id5446 View details Italy Other —
    Ransomware Energie Pool Schweiz id5445 View details Switzerland Other —
    Ransomware M???????? S?? id5393 View details Other —
    Ransomware A10 id5388 View details United States Telecommunications —
    Ransomware Cave Beblenheim id5387 View details Other —
    Ransomware ACS id5386 View details Other —
    Ransomware L?? C??e id5379 View details Other —
    Ransomware ?C? id5378 View details Other —
    Ransomware Point Dedicated Services id5357 View details Services —
    Ransomware Helicar id5298 View details Other —
    Ransomware ADMIRAL Sportwetten id5291 View details Austria Other —
    Ransomware A?????L S?????????? ???? id5283 View details Austria Other —
    Ransomware Arnold Clark id5251 View details Other —
    Ransomware DAYTON PROGRESS id5250 View details Communication / Marketing —
    Ransomware D???? P??????s id5226 View details United Kingdom Other —
    Ransomware A????? ????k id5225 View details United Kingdom Other —
    Ransomware Tarntank Ship Management id5189 View details Services —
    Ransomware Sirius Shipping id5187 View details Transportation / Travel / Logistics —
    Ransomware SUNY Polytechnic Institute id5186 View details Education —
    Ransomware Furetank id5185 View details Sweden Other —
    Ransomware Stratacache id5184 View details United States Public Sector —
    Ransomware S??? id5183 View details Other —
    Ransomware CDER id5182 View details France Other —
    Ransomware FURETANK,SIRIUS SHIPPING,VAS,DONSONET id5138 View details Sweden Transportation / Travel / Logistics —
    Ransomware Cervecería Regional id4955 View details Venezuela, Bolivarian Republic of Other —
    Ransomware F???????, ???, D????????, T???????, S????????????? id4954 View details Other —
    Ransomware OPUS IT Services id4891 View details Services —
    Ransomware H-Hotels id4890 View details Hospitality / Food & Beverage / Tourism —
    Ransomware C???e????? ????????????? id4889 View details Other —
    Ransomware Creta Farm id4888 View details Greece Agriculture / Food —
    Ransomware S?????????? id4886 View details Other —
    Ransomware Arsat id4882 View details Other —
    Ransomware JMicron id4881 View details Other —
    Ransomware VFS id4838 View details Other —
    Ransomware Cetrogar id4837 View details Other —
    Ransomware Una Seguros id4822 View details Other —
    Ransomware Antwerpen id4821 View details Other —
    Ransomware ??????? id4760 View details Other —
    Ransomware Hilldrup id4759 View details Other —
    Ransomware ???? id4757 View details Other —
    Ransomware Skoda Praha id4754 View details Communication / Marketing —
    Ransomware MME Group id4753 View details Services —
    Ransomware Highwater Ethanol id4752 View details Other —
    Ransomware Wrota Mazowsza id4751 View details Other —
    Ransomware UJV Rez id4750 View details Other —
    Ransomware ????????? ???? ????? id4749 View details Other —
    Ransomware CIBTvisas id4743 View details Other —
    Ransomware Austria Presse Agentur id4717 View details Communication / Marketing —
    Ransomware ??? id4686 View details Other —
    Ransomware Verity cloud id4682 View details IT —