Dataforth listed on Play ransomware leak site

• Ransomware group: Play
• Country: United States
• Sector: Technology
• Announcement date: October 6, 2025

Play ransomware group claims data breach at Dataforth

The Play ransomware group has listed the United States-based technology company Dataforth on its leak site. According to the announcement made by the threat actors, the organization has been targeted in a cyberattack. The entry on the leak site was created on October 6, 2025, and the group indicates that the incident itself took place on September 29, 2025.

The threat actors are employing a double-extortion tactic in this instance. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information beforehand. The group threatens to publish the stolen data on their leak site to pressure the victim into paying a ransom. This method increases the pressure on the target, as the threat of public disclosure can lead to significant reputational and legal consequences.

Details of the claimed data theft

The information provided in the leak site listing suggests that the stolen data is quite extensive and sensitive. The group claims to have acquired various types of confidential information that could impact both the company and its stakeholders. The listing specifies that the data includes private and personal confidential data, which poses a significant risk to individual privacy.

Specifically, the following types of data are reported to be involved in the breach:

• Client documents
• Payroll data
• Accounting records
• Tax information
• Identity information
• Financial data

No specific information was provided regarding the total size of the data stolen or the exact number of files involved. Furthermore, there was no mention of a specific ransom demand in the announcement.

About Dataforth

Dataforth is a technology company based in the United States. The company specializes in the manufacturing of high-performance modules and systems designed for industrial data acquisition, signal conditioning, and data communication. Their product expertise is focused on signal conditioners and data acquisition devices that are specifically engineered for use in harsh industrial environments.

Impact and security considerations

The involvement of the Play group, an entity known to have been active since 2022, highlights the ongoing threat posed by sophisticated ransomware operations. Because the group is known for its closed operational style, the process of negotiation following such an incident can become highly complex for the affected organization.

The disclosure of this information carries several significant risks. For Dataforth, the exposure of financial and operational data may create negative impacts on the supply chain. Additionally, the breach increases the risk of identity theft and targeted phishing attacks directed at both Dataforth employees and its customers. When sensitive personal and financial information is leaked, attackers often use it to craft highly convincing social engineering campaigns.

As a United States-based institution, the incident may trigger legal processes under relevant state laws and federal data privacy regulations. Organizations operating in the technology and industrial sectors often face increased scrutiny regarding their data protection measures following such events. To mitigate these risks, organizations typically focus on strengthening their defensive posture through robust encryption, strict access controls, and continuous monitoring to detect unauthorized access before data can be exfiltrated.