Greenwich Leisure listed on Play ransomware leak site

• Ransomware group: Play
• Country: United Kingdom
• Sector: Hospitality
• Announcement date: February 6, 2024

Play ransomware group claims data breach at Greenwich Leisure

The ransomware group known as Play has listed Greenwich Leisure on its leak site, claiming to have exfiltrated sensitive data belonging to the organization. The announcement, posted on February 6, 2024, suggests that the group has obtained information following an attack that allegedly took place on January 22, 2024. The threat actor has threatened to publish the stolen information if their demands are not met.

Details of the alleged attack and data theft

According to the announcement made by the Play group, the breach involves a wide array of sensitive materials. The group claims to have obtained access to private and personal confidential information, which could pose significant risks to the individuals involved. The specific types of data allegedly included in the exfiltration are as follows:

• Client documents
• Payroll data
• IDs
• Tax records
• Insurance information
• Financial information

The group's listing indicates that the stolen information is highly sensitive, covering both administrative and personal aspects of the organization's operations. This type of data theft is a hallmark of modern ransomware operations, where the goal is not just to encrypt systems but to leverage the threat of public exposure to pressure the victim.

About Greenwich Leisure

Greenwich Leisure Limited (GLL) is a non-profit charitable social enterprise that operates a variety of essential public services. The organization manages numerous sports centers, swimming pools, and libraries across the United Kingdom. Operating under the 'Better' brand, GLL provides public sports and leisure facilities to communities, serving as a significant provider of social and recreational infrastructure.

Implications and potential risks

This incident may increase the risk of identity theft and fraud for the organization's employees and customers due to the nature of the allegedly exfiltrated data. Furthermore, the sensitive nature of the information involved could lead to significant compliance issues under the UK GDPR, as the organization is responsible for protecting the personal data of its users and staff.

The Play group is known for utilizing double extortion tactics. In such scenarios, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish the data on a public leak site, the group increases the pressure on the organization to comply with their demands. Such leaks can cause lasting damage to an organization's reputation and create secondary risks for its various supply chain partners.

While information regarding the Play group remains limited, this incident highlights the ongoing risks faced by social enterprises and public service providers. Organizations in the hospitality and leisure sectors can mitigate such risks by implementing robust security frameworks, ensuring strict adherence to data protection regulations, and maintaining comprehensive monitoring of their networks to detect unauthorized data exfiltration early.