Play

Active
1,393 victims named on the leak site
15 in the last 30 days
327 in the last 12 months
Feb 2022 first victim we recorded
Sep 9, 2026 most recent victim posted
25 leak sites tracked

Data as of September 9, 2026.

Credential exposure before the attack

30.4% of Play victims whose domain we can identify (423 of 1,393) had employee credentials leak in the 12 months before Play named them as a victim.

We don't know whether any of these credentials were how Play gained initial access.

What industries Play targets

Sector identified for 784 of 1,393 victims.

Manufacturing237
Construction121
Financial Services73
Technology62
Logistics61
Legal34
Energy31
Real Estate30

Where the victims are located

Country identified for 543 of 1,393 victims.

United States312
Canada47
Germany29
United Kingdom20
Sweden14
France12
Netherlands12
Switzerland12

Most recent Play victims

VictimSectorCountryPosted
GT Distributors gtdist.comRetailUnited StatesSep 9, 2026
Red Star Oil redstaroil.comEnergyUnited StatesSep 9, 2026
Figgins Family Wine Estates figginsfamily.comManufacturingUnited StatesSep 1, 2026
KRC Machine Tool Solutions krcmachinetoolsolutions.comManufacturingUnited StatesSep 1, 2026
Meteor Group meteor.deManufacturingGermanySep 1, 2026
Mobilier MEQ mobiliermeq.comManufacturingCanadaSep 1, 2026
Be Media bemedia.comHospitalityUnited StatesAug 21, 2026
Latoplast latoplast.comNot identifiedCanadaAug 21, 2026
Bridgeport Capital Services bridgeportcapital.comFinancial ServicesUnited StatesAug 19, 2026
Coltrane Systems coltranesystems.comNot identifiedUnited StatesAug 19, 2026
Sam Pack Auto Group sampack.comAutomotiveUnited StatesAug 19, 2026
Woodhaven Association woodhavenassociation.comHospitalityUnited StatesAug 19, 2026
Rilpa Enterprises helis.comNot identifiedCanadaAug 10, 2026
Marconi Industrial Services marconi-spa.comManufacturingItalyAug 10, 2026
MIE Solutions mie-solutions.comManufacturingUnited StatesAug 10, 2026
GCATS gcatstx.comNot identifiedNot identifiedAug 7, 2026
Platinum Group platinum-grp.comNot identifiedNot identifiedAug 7, 2026
Signature Services signatureservices.netNot identifiedNot identifiedAug 7, 2026
First Tek first-tek.comTechnologyUnited StatesAug 5, 2026
Preferred Financial Group preferredfinancial.comLogisticsUnited StatesAug 5, 2026

Showing the 20 most recent of 1,393. Browse recent data breaches for more.

Play leak sites

Addresses we've seen Play publish victims from. Any .onion address needs the Tor Browser.

  • mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion
  • x6zdxw6vt3gtpv35yqloydttvfvwyrju3opkmp4xejmlfxto7ahgnpyd.onion
  • b3pzp6qwelgeygmzn6awkduym6s4gxh6htwxuxeydrziwzlx63zergyd.onion
  • p2qzf3rfvg4f74v2ambcnr6vniueucitbw6lyupkagsqejtuyak6qrid.onion
  • whfsjr35whjtrmmqqeqfxscfq564htdm427mjekic63737xscuayvkad.onion
  • k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion
  • j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion
  • g7iekx6bnby3v5pxtkmvccml56oxcnev45unkk6blekpopxbnaim3uid.onion
  • ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion
  • z7u6dkys7b2aeibvklxga7mldzrepoauiuniqwfhdadkkwwgmv6bqhad.onion
  • 37wb3ygyb3r2vf2dt5o3ca62zlduuowvkkwjrtbcgc5iri4t6rnzr7yd.onion
  • iejj6bywviuecjwi3kxanzojqroe3j3phzgplvrdzcicimtcw6xgk3yd.onion
  • sm2gah7bjg6u2dfl3voiex6njh2kcuqqquvv7za37xokmbcivsgqcnad.onion
  • giqbwqkirupaid4znksu47k7no7s747dkdcciapem4vcb33ubljpreid.onion
  • zi34ocznt242jallttwvvhihrezjdzfgflf3uhdv6t3z23hhcn54efid.onion
  • doz7omlqqanryonvil4iuj65shzcv3efupqwubkza6553wnekrrd4uid.onion
  • kri3lez34pbqra3xs5wxo55djldtsekol6tuqdjqecqzga6dpnjqruyd.onion
  • veu6krzumw27cldjbzvuq2j2vejhl4fhiv6ftwhpku5zpncxbiu5ljad.onion
  • d3qbonvtq57comzwfiuxqi2x4pgt362aqb5qgigejibblnxyqmide7yd.onion
  • slg7tnjb65swwyaebnyymyvo73xm36hxwugdsps7cwcxicizyzyt2byd.onion
  • jnbiz5lp44ddg4u5rsr4yebbpxa3iytcsshgbqa4m6r6po5y57h6yxid.onion
  • v3r6g4q3b2jpqusznecxexr5aqi42vy5ts6jy6fu3strecvb5c2woead.onion
  • mega.nz
  • xb6q2aggycmlcrjtbjendcnnwpmmwbosqaugxsqb4nx6cmod3emy7sad.onion
  • eppsldmcnv3ylabsx5srvf36wnk6jrowg6x4unxclv55rnu4kf5436yd.onion

Play questions

Is Play still active?

Yes. Play posted its most recent victim on September 9, 2026. That's 15 victims in the last 30 days.

How many victims has Play claimed?

Play has named 1,393 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 327 of them were posted in the last 12 months.

When did Play first appear?

The first victim we recorded for Play was posted on February 9, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Play target?

Manufacturing accounts for the most victims we can classify, with 237. Construction follows at 121. We could identify a sector for 784 of 1,393 victims, so treat this as the shape of the targeting rather than a full census.

Has Play already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.