Play

Play is a ransomware group that operates under the alias Play and has its headquarters located in Argentina. The group’s primary activity involves deploying ransomware to encrypt victims’ critical systems and then demanding payment for decryption keys. In addition to encryption, Play routinely threatens to publish stolen data if the ransom is not paid, a tactic known as double extortion. The group’s modus operandi has been observed in attacks targeting both public‑sector institutions and private companies.

One of the documented incidents occurred on 6 December 2022, when Play targeted the Congress of Jalisco, a legislative body in Mexico, encrypting its servers and disrupting administrative operations. In the same campaign, the group also attacked a major Argentinian retailer, causing operational disruptions that forced the company to revert to manual invoicing and raising concerns about warranty processes for customers. During the retailer attack, Play threatened to release sensitive internal data, including employee documents and biometric information.

These incidents illustrate Play’s focus on high‑impact targets where service interruption can generate pressure to pay the ransom, and its willingness to leverage data‑leak threats to increase extortion leverage. The group’s capability to infiltrate networks, deploy encryption payloads, and exfiltrate data points to a level of technical proficiency typical of organized ransomware syndicates. No further details about the group’s size, revenue, or employee count are provided in the available source material.

Similarly, the sources do not disclose any information regarding Play’s ownership structure, parent‑company relationships, or subsidiary affiliations. Consequently, any description of the group’s corporate governance or financial backing would be speculative and is omitted here. The profile is therefore limited to the confirmed facts concerning Play’s ransomware activities, known targets, and operational tactics as reported in the incident overview.