[PLAY] – Ransomware Victim: Evogence

image

NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the PLAY Onion Dark Web Tor Blog page.

Ransomware group:
PLAY
Victim name:
EVOGENCE

AI Generated Summary of the Ransomware Leak Page

On November 1, 2025, Evogence, a US-based technology company specializing in computer equipment and peripherals, appears to be a victim in a ransomware leak post. The leak page frames the incident as a data leak, alleging that private and personal confidential data, client documents, budgets, payroll records, employee IDs, tax information, and other financial data were compromised. The post date listed is 2025-11-01, with an earlier addition date of 2025-10-28; there is no separate compromise date provided in the data, so the post date is treated as the leak’s date. The page references Evogence’s site in a brief body excerpt but does not disclose a ransom amount in the metadata.

The leak entry shows 112 views and indicates there are no downloads, no screenshots, and no external links visible on the page. A claim URL is present, which is typical of ransomware leak posts that offer an extortion channel. The reported data volume is not disclosed (size_gb and amount_of_data appear as ??? gb), and there is no explicit ransom figure. The body excerpt continues to reference Evogence, reinforcing the victim identification without detailing the data types beyond the categories described earlier.

In summary, the Evogence leak entry denotes a data-leak event associated with ransomware, lacking a disclosed data volume or ransom figure but indicating sensitive information exposure. The page shows no images or downloadable content, and the presence of a claim URL suggests potential extortion activity. This incident reinforces the ongoing risk to technology-sector organizations in the United States from ransomware campaigns that publicly disclose stolen data, and it underscores the importance of prompt data exposure assessment and incident response.

Support Our Work

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.

AI APIs OSINT driven New features