Play

Active

1,405 victims named on the leak site

18 in the last 30 days

288 in the last 12 months

Feb 2022 first victim we recorded

Oct 1, 2026 most recent victim posted

25 leak sites tracked

Data as of October 1, 2026.

Credential exposure before the attack

30.1% of Play victims whose domain we can identify (423 of 1,405) had employee credentials leak in the 12 months before Play named them as a victim.

We don't know whether any of these credentials were how Play gained initial access.

What industries Play targets

Sector identified for 791 of 1,405 victims.

Manufacturing	239
Construction	122
Financial Services	73
Technology	62
Logistics	61
Legal	34
Energy	31
Real Estate	30

Where the victims are located

Country identified for 555 of 1,405 victims.

United States	317
Canada	50
Germany	31
United Kingdom	20
Sweden	14
France	12
Netherlands	12
Switzerland	12

Most recent Play victims

Victim	Sector	Country	Posted
Airtech Mechanical Services airtechnc.com	Not identified	United States	Oct 1, 2026
Orth Automobile orth-automobile.de	Automotive	Germany	Oct 1, 2026
Titus titus.de	Retail	Germany	Oct 1, 2026
Ever Ready First Aid everreadyfirstaidusa.com	Healthcare	United States	Sep 29, 2026
Starr Whitehouse Landscape Architects and Planners starrwhitehouse.com	Not identified	United States	Sep 29, 2026
Hurley hurleyco.net	Construction	United States	Sep 22, 2026
Metallco metallco.com	Not identified	Norway	Sep 22, 2026
Barrett Mahony Consulting Engineers barrettmahony.com	Not identified	Ireland	Sep 21, 2026
Inglewood Golf & Curling Club inglewoodgolfclub.ca	Non-profit	Canada	Sep 21, 2026
Vista Plastic Solutions vistahelps.com	Manufacturing	Canada	Sep 21, 2026
Grunthal Welding & Supplies grunthalwelding.com	Manufacturing	Canada	Sep 11, 2026
Sys-Kool sys-kool.com	Not identified	United States	Sep 11, 2026
GT Distributors gtdist.com	Retail	United States	Sep 9, 2026
Red Star Oil redstaroil.com	Energy	United States	Sep 9, 2026
Figgins Family Wine Estates figginsfamily.com	Manufacturing	United States	Sep 1, 2026
KRC Machine Tool Solutions krcmachinetoolsolutions.com	Manufacturing	United States	Sep 1, 2026
Meteor Group meteor.de	Manufacturing	Germany	Sep 1, 2026
Mobilier MEQ mobiliermeq.com	Manufacturing	Canada	Sep 1, 2026
Be Media bemedia.com	Hospitality	United States	Aug 21, 2026
Latoplast latoplast.com	Not identified	Canada	Aug 21, 2026

Showing the 20 most recent of 1,405. Browse recent data breaches for more.

Play leak sites

Addresses we've seen Play publish victims from. Any .onion address needs the Tor Browser.

mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion
x6zdxw6vt3gtpv35yqloydttvfvwyrju3opkmp4xejmlfxto7ahgnpyd.onion
b3pzp6qwelgeygmzn6awkduym6s4gxh6htwxuxeydrziwzlx63zergyd.onion
p2qzf3rfvg4f74v2ambcnr6vniueucitbw6lyupkagsqejtuyak6qrid.onion
whfsjr35whjtrmmqqeqfxscfq564htdm427mjekic63737xscuayvkad.onion
k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion
j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion
g7iekx6bnby3v5pxtkmvccml56oxcnev45unkk6blekpopxbnaim3uid.onion
ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion
z7u6dkys7b2aeibvklxga7mldzrepoauiuniqwfhdadkkwwgmv6bqhad.onion
37wb3ygyb3r2vf2dt5o3ca62zlduuowvkkwjrtbcgc5iri4t6rnzr7yd.onion
iejj6bywviuecjwi3kxanzojqroe3j3phzgplvrdzcicimtcw6xgk3yd.onion
sm2gah7bjg6u2dfl3voiex6njh2kcuqqquvv7za37xokmbcivsgqcnad.onion
giqbwqkirupaid4znksu47k7no7s747dkdcciapem4vcb33ubljpreid.onion
zi34ocznt242jallttwvvhihrezjdzfgflf3uhdv6t3z23hhcn54efid.onion
doz7omlqqanryonvil4iuj65shzcv3efupqwubkza6553wnekrrd4uid.onion
kri3lez34pbqra3xs5wxo55djldtsekol6tuqdjqecqzga6dpnjqruyd.onion
veu6krzumw27cldjbzvuq2j2vejhl4fhiv6ftwhpku5zpncxbiu5ljad.onion
d3qbonvtq57comzwfiuxqi2x4pgt362aqb5qgigejibblnxyqmide7yd.onion
slg7tnjb65swwyaebnyymyvo73xm36hxwugdsps7cwcxicizyzyt2byd.onion
jnbiz5lp44ddg4u5rsr4yebbpxa3iytcsshgbqa4m6r6po5y57h6yxid.onion
v3r6g4q3b2jpqusznecxexr5aqi42vy5ts6jy6fu3strecvb5c2woead.onion
mega.nz
xb6q2aggycmlcrjtbjendcnnwpmmwbosqaugxsqb4nx6cmod3emy7sad.onion
eppsldmcnv3ylabsx5srvf36wnk6jrowg6x4unxclv55rnu4kf5436yd.onion

Play questions

Is Play still active?

Yes. Play posted its most recent victim on October 1, 2026. That's 18 victims in the last 30 days.

How many victims has Play claimed?

Play has named 1,405 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 288 of them were posted in the last 12 months.

When did Play first appear?

The first victim we recorded for Play was posted on February 9, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Play target?

Manufacturing accounts for the most victims we can classify, with 239. Construction follows at 122. We could identify a sector for 791 of 1,405 victims, so treat this as the shape of the targeting rather than a full census.

Has Play already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.