[PLAY] – Ransomware Victim: Custom Paper

image

Ransomware Group: PLAY

VICTIM NAME: Custom Paper

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the PLAY Onion Dark Web Tor Blog page.


AI Generated Summary of the Ransomware Leak Page

The ransomware leak page publicly exposes details related to an attack on a manufacturing entity operating under the domain Custom Paper. The attack was discovered on May 1, 2025, with the compromise reportedly occurring on the same day. The incident involved the theft of sensitive data, which was subsequently leaked on the dark web platform associated with the group “play.” The leak is accompanied by a screenshot showing internal documents or data, indicating that the attackers may have accessed proprietary or confidential information.

While specific details of the compromised data are not provided in this summary, the leak poses a significant risk to the organization’s operations and reputation. The leak page contains a link to a claim URL on a dark web onion site, which is typically used by threat actors to provide proof or evidence of the attack. The victim is based in Canada, and their industry is manufacturing. The presented information highlights the importance of cybersecurity vigilance for organizations handling sensitive or proprietary data, especially in the manufacturing sector where operational continuity is critical. No personally identifiable information (PII) or detailed internal content has been disclosed here, maintaining the focus on the attack’s overview rather than sensitive specifics.


A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below

To keep up to date follow us on the below channels.