Dallis Law Firm listed on Play ransomware leak site

• Ransomware group: Play
• Country: United States
• Sector: Professional Services
• Announcement date: June 4, 2026

Play ransomware group claims breach of Dallis Law Firm

The Play ransomware group has officially listed Dallis Law Firm on its dedicated leak site. According to the announcement, the threat actor group claims to have successfully exfiltrated data from the organization, threatening to publish the stolen information if their demands are not met.

This type of announcement is a common tactic used by ransomware operators to exert pressure on victims. By publicly naming an organization, the group aims to damage the victim's reputation and create urgency through the threat of exposing sensitive information to the public or its competitors.

Details of the alleged attack

Based on the information provided by the threat actor, the incident began shortly before the public announcement. The Play group claims to have gained unauthorized access to the systems of Dallis Law Firm on June 2, 2026. Following this initial access, the group subsequently posted the organization on their leak site on June 4, 2026.

The announcement indicates that the organization's private and confidential data is slated for publication. In such scenarios, ransomware groups often use a method known as double extortion. In this tactic, attackers do not just encrypt the victim's files to disrupt operations; they also steal sensitive data beforehand. The threat of leaking this stolen data serves as a secondary layer of leverage, ensuring that even if the organization can restore its systems from backups, they still face the risk of public exposure and regulatory scrutiny.

Reported compromised data types

The group has provided screenshots to support their claims, which suggest a significant breach of sensitive information. The data allegedly stolen includes a wide variety of confidential materials that could be highly damaging if released. The following types of data are reportedly involved:

• Client documents
• Payroll records
• Identification documents
• Tax records
• Financial information

The inclusion of such diverse data types suggests a deep level of access into the organization's internal file structures and administrative databases.

About Dallis Law Firm

Dallis Law Firm is a professional services organization located in the United States. Specifically, the firm is based in the state of South Carolina. The firm specializes in legal matters involving personal injury and workers' compensation cases, which inherently involves handling highly sensitive personal and medical information belonging to their clients.

Risk assessment and organizational implications

The Play group is a known threat actor that has been observed in the cyber threat landscape since 2022. They are recognized for their use of double extortion tactics, which significantly increases the stakes for any targeted organization. This alleged breach may pose a substantial risk of exposing sensitive information belonging to the law firm's clients, potentially leading to long-term consequences for the individuals involved.

Because the organization is based in the United States, the incident may trigger various legal and regulatory obligations. The firm may face data breach notification requirements under relevant state laws and federal regulations. Furthermore, the nature of the stolen data—including identification and financial records—creates a high possibility that the leaked information could be utilized by malicious actors for identity theft and targeted phishing attacks against the firm or its clients.

The operational style of the Play group is often described as closed, which suggests that any potential negotiation processes regarding the data could prove to be challenging for the victim. For organizations in the professional services sector, such incidents underscore the necessity of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining offline backups, conducting regular security awareness training, and ensuring strict access controls to limit the movement of attackers within a network.