Play

Active
1,381 victims named on the leak site
20 in the last 30 days
324 in the last 12 months
Feb 2022 first victim we recorded
Aug 10, 2026 most recent victim posted
25 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

30.5% of Play victims whose domain we can identify (421 of 1,381) had employee credentials leak in the 12 months before Play named them as a victim.

We don't know whether any of these credentials were how Play gained initial access.

What industries Play targets

Sector identified for 775 of 1,381 victims.

Manufacturing233
Construction121
Financial Services73
Technology62
Logistics61
Legal34
Energy30
Real Estate30

Where the victims are located

Country identified for 533 of 1,381 victims.

United States304
Canada45
Germany29
United Kingdom20
Sweden14
Netherlands12
Switzerland12
France12

Most recent Play victims

VictimSectorCountryPosted
Rilpa Enterprises helis.comNot identifiedCanadaAug 10, 2026
Marconi Industrial Services marconi-spa.comManufacturingItalyAug 10, 2026
MIE Solutions mie-solutions.comManufacturingUnited StatesAug 10, 2026
GCATS gcatstx.comNot identifiedNot identifiedAug 7, 2026
Platinum Group platinum-grp.comNot identifiedNot identifiedAug 7, 2026
Signature Services signatureservices.netNot identifiedNot identifiedAug 7, 2026
First Tek first-tek.comTechnologyUnited StatesAug 5, 2026
Preferred Financial Group preferredfinancial.comLogisticsUnited StatesAug 5, 2026
Cambridge Management cambridgemgmt.netReal EstateUnited StatesAug 3, 2026
Sigma Plastics Group sigmaplasticsgroup.comManufacturingUnited StatesAug 3, 2026
The Butcher Brothers thebutcherbrotherscorp.comRetailUnited StatesAug 3, 2026
Record Go Mobility recordrentacar.comNot identifiedSpainJul 24, 2026
Restaurant Depot restaurantdepot.comHospitalityUnited StatesJul 24, 2026
Kreysler & Associates kreysler.comManufacturingUnited StatesJul 22, 2026
Tax-MT tax-mt.comFinancial ServicesUnited StatesJul 22, 2026
AG Scholtes agscholtes.nlNot identifiedNetherlandsJul 17, 2026
Andorralife andorralife.comRetailUnited StatesJul 17, 2026
Boston Electric and Telephone betcorp.comConstructionUnited StatesJul 17, 2026
Svensk Direktreklam sdr.seNot identifiedSwedenJul 17, 2026
Wring Group wringgroup.co.ukConstructionUnited KingdomJul 17, 2026

Showing the 20 most recent of 1,381. Browse recent data breaches for more.

Play leak sites

Addresses we've seen Play publish victims from. Any .onion address needs the Tor Browser.

  • mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion
  • x6zdxw6vt3gtpv35yqloydttvfvwyrju3opkmp4xejmlfxto7ahgnpyd.onion
  • b3pzp6qwelgeygmzn6awkduym6s4gxh6htwxuxeydrziwzlx63zergyd.onion
  • p2qzf3rfvg4f74v2ambcnr6vniueucitbw6lyupkagsqejtuyak6qrid.onion
  • whfsjr35whjtrmmqqeqfxscfq564htdm427mjekic63737xscuayvkad.onion
  • k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion
  • j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion
  • g7iekx6bnby3v5pxtkmvccml56oxcnev45unkk6blekpopxbnaim3uid.onion
  • ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion
  • 37wb3ygyb3r2vf2dt5o3ca62zlduuowvkkwjrtbcgc5iri4t6rnzr7yd.onion
  • z7u6dkys7b2aeibvklxga7mldzrepoauiuniqwfhdadkkwwgmv6bqhad.onion
  • iejj6bywviuecjwi3kxanzojqroe3j3phzgplvrdzcicimtcw6xgk3yd.onion
  • sm2gah7bjg6u2dfl3voiex6njh2kcuqqquvv7za37xokmbcivsgqcnad.onion
  • giqbwqkirupaid4znksu47k7no7s747dkdcciapem4vcb33ubljpreid.onion
  • zi34ocznt242jallttwvvhihrezjdzfgflf3uhdv6t3z23hhcn54efid.onion
  • doz7omlqqanryonvil4iuj65shzcv3efupqwubkza6553wnekrrd4uid.onion
  • veu6krzumw27cldjbzvuq2j2vejhl4fhiv6ftwhpku5zpncxbiu5ljad.onion
  • d3qbonvtq57comzwfiuxqi2x4pgt362aqb5qgigejibblnxyqmide7yd.onion
  • kri3lez34pbqra3xs5wxo55djldtsekol6tuqdjqecqzga6dpnjqruyd.onion
  • mega.nz
  • v3r6g4q3b2jpqusznecxexr5aqi42vy5ts6jy6fu3strecvb5c2woead.onion
  • slg7tnjb65swwyaebnyymyvo73xm36hxwugdsps7cwcxicizyzyt2byd.onion
  • jnbiz5lp44ddg4u5rsr4yebbpxa3iytcsshgbqa4m6r6po5y57h6yxid.onion
  • xb6q2aggycmlcrjtbjendcnnwpmmwbosqaugxsqb4nx6cmod3emy7sad.onion
  • eppsldmcnv3ylabsx5srvf36wnk6jrowg6x4unxclv55rnu4kf5436yd.onion

Play questions

Is Play still active?

Yes. Play posted its most recent victim on August 10, 2026. That's 20 victims in the last 30 days.

How many victims has Play claimed?

Play has named 1,381 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 324 of them were posted in the last 12 months.

When did Play first appear?

The first victim we recorded for Play was posted on February 9, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Play target?

Manufacturing accounts for the most victims we can classify, with 233. Construction follows at 121. We could identify a sector for 775 of 1,381 victims, so treat this as the shape of the targeting rather than a full census.

Has Play already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.