Eastman Cooke listed on Play ransomware leak site

• Ransomware group: Play
• Country: United States
• Sector: Manufacturing
• Announcement date: December 13, 2025

The Play ransomware group has listed Eastman Cooke on its dedicated leak site, claiming to be in possession of the company's private data. This announcement, made on December 13, 2025, marks a significant development in the ongoing targeting of organizations within the construction and management sectors by high-profile threat actors.

The claimed attack and event details

According to the announcement made by the threat actor known as Play, the organization has been targeted in a data breach. The group alleges that the breach occurred around November 25, 2025, though the official listing on their leak site was not made until December 13, 2025. The threat actor has indicated that the data discovered during this incident is scheduled for publication on their platform.

Ransomware leak sites serve as a public stage for cybercriminals to exert pressure on their victims. These sites are used to host lists of compromised organizations, often accompanied by countdown timers or specific threats to release sensitive information if certain conditions are not met. This tactic is a hallmark of modern ransomware operations, shifting the focus from simple encryption to the exploitation of stolen information.

Data types involved in the alleged breach

The Play group claims to have obtained a variety of private and confidential information during the alleged attack. The scope of the data mentioned in the announcement suggests a significant exposure of sensitive corporate and personal records. The specific categories of data identified in the claim include:

• Client documents
• Payroll information
• Identification documents
• Tax records
• Financial information

While the specific volume of the data and the exact file count have not been provided by the group, the nature of the listed items points toward a broad compromise of administrative and personal files. In many ransomware scenarios, the theft of such diverse data types is a deliberate strategy to maximize the impact of the breach.

About Eastman Cooke

Eastman Cooke is a general contracting and construction management firm that is based in New York. The organization provides a wide range of construction services across various sectors, including commercial, institutional, and residential projects. Given its role in managing complex infrastructure and building projects, the firm handles a significant amount of documentation related to clients, contractors, and employees.

Risk assessment and industry implications

This incident may increase the risk of identity theft and fraud for the company's employees and clients. The alleged exposure of financial and personal data could lead to legal liabilities for the organization under relevant US state data protection laws and regulations. Because the Play group is known for employing double extortion tactics, the publication of this data may be intended to exert pressure on the organization.

Double extortion is a method where attackers not only encrypt an organization's systems but also steal sensitive data, threatening to leak it publicly to force a ransom payment. This approach increases the pressure on companies, as even if they can restore systems from backups, they still face the threat of reputational damage and regulatory scrutiny resulting from the data leak.

In the future, this data could potentially be utilized in targeted phishing campaigns or serve as a basis for secondary cyberattacks. For organizations in the construction and management sector, such incidents highlight the importance of robust data protection strategies. Common defensive steps often include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access through phishing or other common vectors.