Ransomware Group: PLAY

VICTIM NAME: Morrison Companies

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the PLAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The leak page pertains to Morrison Companies, a business based in the United States. The compromised data was discovered on July 16, 2025, with the attack date also recorded as July 16, 2025. The organization appears to operate in a sector with unspecified activity, and no detailed information about the nature of the breach or the type of data compromised is provided. The webpage includes a screenshot that likely demonstrates internal documents or data leaks, contributing to the understanding of the extent of the breach. No specific infostealer or malicious code is indicated, but the leak suggests sensitive information has been exposed online.

The leak page may contain links or references to stolen data, although no explicit download links are provided in the available information. The page is hosted on a dark web platform accessible via the provided claim URL. The presentation suggests a public declaration of the breach, possibly to pressure the victim or attract attention from potential data buyers or other threat actors. The overall context points to a significant data compromise affecting Morrison Companies, emphasizing the importance of proactive cybersecurity measures to prevent and mitigate similar incidents in the future.