Due Doyle Fanning listed on play ransomware leak site

• Ransomware group: play
• Country: United States
• Sector: Professional Services
• Announcement date: January 6, 2026

The threat actor known as play has listed the organization Due Doyle Fanning on its leak site. The group claims to have successfully compromised the systems of the US-based entity, marking a new incident involving the professional services sector.

The claimed attack and event details

According to the announcement made on the play ransomware group's leak site on January 6, 2026, the group claims to have targeted Due Doyle Fanning. The threat actor asserts that they have gained unauthorized access to the institution's internal systems. While the announcement was made in early January, the group claims the actual attack occurred on December 26, 2025.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms by threatening to release stolen data. This specific incident involves the use of double extortion, a tactic where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. In a double extortion scenario, the threat actor threatens to publish the stolen data on a public leak site if the ransom demands are not met, significantly increasing the pressure on the victim organization.

Data types claimed by the threat actor

The play group claims to be in possession of a variety of sensitive and confidential information. The group asserts that the stolen data includes private documents and highly sensitive materials that could impact the organization and its stakeholders. The specific categories of data mentioned in the claim include:

• Client documents
• Payroll information
• IDs
• Tax records
• Financial information

No information was provided regarding the total size of the data stolen or the specific number of files involved in the breach. Furthermore, the group has not disclosed a specific ransom demand in their announcement.

The organization profile

Due Doyle Fanning is an organization based in the United States. The entity operates within the professional services sector, specifically providing legal services. This positioning within the legal sector means the organization handles sensitive information that is subject to strict confidentiality requirements and various regulatory frameworks.

Implications and industry considerations

The claims made by the play group pose significant risks to the institution's clients and employees. The types of data mentioned, such as IDs, tax records, and financial information, are highly valuable for identity theft and fraudulent activities. Because the entity is based in the United States, the incident may trigger various state-level data breach notification laws and other relevant privacy regulations designed to protect consumer information.

For organizations operating in the legal sector, such incidents carry additional legal and ethical implications due to the high standard of client confidentiality required by the profession. The potential for the leaked data to be used in secondary attacks, such as targeted phishing campaigns, remains a high risk when double extortion tactics are employed. The group's reported closed operational style suggests that any potential negotiation processes could be complex.

To mitigate such risks, organizations in the professional services sector often implement defensive measures such as multi-factor authentication, regular security awareness training, and robust encryption for data at rest and in transit. Maintaining comprehensive backups and a tested incident response plan are also standard industry practices to defend against the disruptive nature of ransomware attacks.