Ransomware Group: PLAY

VICTIM NAME: Biofloral

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the PLAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The victim of this ransomware attack is a company involved in the agriculture and food production sector, located in France. The incident was publicly disclosed on July 3, 2025, with the attack date similarly recorded as July 3, 2025. The affected organization’s website is identified as www.biofloral.com. The leak page indicates that sensitive information or data related to this attack may be accessible through a provided dark web link. Visual evidence such as screenshots is not available, but the page includes details emphasizing the nature of the breach and potential data compromise. No specific infostealer malware or malicious activity has been explicitly confirmed, but the leak highlights the importance of cybersecurity for companies in this industry sector. Additional information about the breach, such as leak contents or data images, was not provided, but the compromised data could include confidential business documents or internal communications.

Authorities and security professionals are advised to monitor the situation, especially given the attack’s timing and targeted industry. The leak page is part of a broader campaign by a group identified as “play,” which is known for engaging in ransomware extortion efforts. Companies in similar sectors should review their cybersecurity measures and prepare for potential data exposure. Although specific details about files or data types have not been disclosed publicly, the incident underscores the persistent threat ransomware poses to critical infrastructure and commercial entities. The absence of visual or explicit evidence makes it crucial to treat this report as an alert rather than definitive proof of data compromise. Ongoing investigation and cybersecurity vigilance are recommended to prevent further incidents.