Ransomware Group: PLAY

VICTIM NAME: Sunrise Springs Spa Resort

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the PLAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to Sunrise Springs Spa Resort, a business operating within the hospitality and tourism industry in the United States. The attack was publicly disclosed on June 27, 2025, with the breach occurring on the same date. The leak page includes a screenshot of an internal document or system interface, indicating a potential breach of sensitive operational information. The attackers have made claims about the compromised data, though specific details of the information leaked are not publicly detailed on the page.

The page provides a link to a dark web portal where further information and potential data dumps are accessible. The leak appears to be part of a broader attack campaign by a group identified as “play,” which has targeted organizations in various sectors. While the exact scope of the data compromised is not explicitly listed, the presence of screenshots suggests that internal documents or business-related data may have been exposed. No personally identifiable information or sensitive customer data is directly shown in the available content, but the leak indicates a significant security breach involving operational infrastructure of the resort. Overall, the incident underscores the growing threat to hospitality businesses facing ransomware demands, emphasizing the importance of cybersecurity resilience.