Metallco listed on Play ransomware leak site

• Ransomware group: Play
• Country: Brazil
• Sector: Manufacturing
• Announcement date: September 21, 2026

Play ransomware group targets Metallco

The Play ransomware group has officially listed the Norwegian company Metallco on its dedicated leak site. According to the announcement made on September 21, 2026, the threat actors claim to have successfully exfiltrated various types of sensitive information from the organization. This development follows the group's established pattern of targeting specific entities and using public pressure to further their objectives.

The incident is characterized by the use of double extortion tactics. In such scenarios, ransomware groups do not merely encrypt an organization's internal systems to disrupt operations; they also steal sensitive data prior to the encryption phase. By threatening to publish this stolen information on a public leak site, the attackers aim to maximize their leverage during ransom negotiations, using the threat of reputational damage and legal repercussions as a primary tool for coercion.

The group has set a deadline for the publication of the stolen data, stating that the information will be released on September 25, 2026. This countdown is a common tactic used by ransomware groups to create a sense of urgency and heighten the pressure on the victimized organization to meet their demands.

Claimed data exfiltration details

The announcement made by the Play group specifies a wide range of sensitive information that has allegedly been stolen from Metallco. The group claims that the breach includes highly confidential documents that could impact both the company's internal operations and its external relationships. The types of data mentioned in the leak site announcement include:

• Personal data
• Client documents
• Budget data
• Payroll data
• IDs
• Tax records
• Financial data

The inclusion of such diverse data types—ranging from individual identification and payroll information to corporate financial and tax records—suggests a comprehensive breach of the organization's digital environment. The group has not provided specific details regarding the total volume of data stolen or the exact number of files compromised.

About Metallco

Metallco is a Norway-based company that operates within the manufacturing sector, specifically specializing in metal recycling and scrap metal trading. The organization plays a role in the circular economy by managing the collection, processing, and recovery of various types of metals. Their operations involve complex logistical and industrial processes to ensure that metals are recovered and returned to the economy efficiently.

Risk assessment and organizational implications

This incident carries significant implications for both the organization and the individuals whose data may have been compromised. The alleged theft of personal data, IDs, and payroll information suggests that Metallco's employees may face heightened risks of identity theft. Furthermore, the potential exposure of client documents and financial records could damage the trust between the company and its business partners.

From a commercial standpoint, the exfiltration of financial and tax records increases the risk of secondary attacks. Threat actors often use stolen financial intelligence to conduct highly targeted business email compromise (BEC) attacks or other fraudulent activities targeting an institution's commercial operations. Additionally, because Metallco is based in Norway, this incident may lead to significant legal consequences under the European Union's General Data Protection Regulation (GDPR), which mandates strict protections for personal data and imposes heavy penalties for non-compliance or failure to secure data.

The Play group, which has been known to be active since 2022, continues to utilize these high-pressure tactics to exert influence. For organizations operating in the manufacturing and recycling sectors, this incident highlights the necessity of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access and subsequent data exfiltration.