Milwaukee Forge listed on Play ransomware leak site

• Ransomware group: Play
• Country: United States
• Sector: Manufacturing
• Announcement date: February 10, 2026

Play ransomware group claims data breach at Milwaukee Forge

The ransomware group known as Play has listed the United States-based manufacturing company Milwaukee Forge on its dedicated leak site. According to the announcement made on February 10, 2026, the threat actors claim to have successfully breached the organization's systems and exfiltrated various datasets. The group's listing indicates that they have gained unauthorized access to the company's internal environment, leading to a potential data leak.

The incident, which the group claims began around January 20, 2026, follows a pattern of activity observed with this specific threat actor. Currently, the leak site features an active countdown timer, which suggests that the group intends to publish the stolen information publicly if their demands are not met. This tactic is a hallmark of modern ransomware operations, where the pressure to release data is used as a primary leverage tool against the victim organization.

Details of the claimed data exfiltration

While the specific volume of data and the exact file count have not been disclosed by the attackers, the group has provided a detailed list of the types of information they claim to have stolen. The leaked content is described as containing highly sensitive and confidential material that could impact various stakeholders of the organization. The announcement specifies that the stolen datasets include:

• Client documents
• Budget records
• Payroll
• IDs
• Tax records
• Financial information

The inclusion of such diverse data types—ranging from internal financial records to personal identification and payroll information—highlights the breadth of the alleged intrusion. The presence of personal identifiers and tax records suggests that the breach may extend beyond corporate files to include sensitive employee and client information.

About Milwaukee Forge

Milwaukee Forge is a manufacturing company operating within the United States. The organization specializes in the production of forged metal parts and various industrial components. As a provider of specialized metalworking solutions, the company serves a wide array of critical sectors, including the automotive industry, the agricultural sector, and heavy industry. Such a role in the supply chain underscores the potential impact of a cyber disruption on the broader industrial ecosystem.

Analysis and potential implications

This alleged data breach poses significant risks, particularly regarding identity theft and fraud, for both the employees and the clients of Milwaukee Forge. Because the organization is based in the United States, the incident may trigger various legal obligations under state-level data breach notification laws and existing regulatory frameworks. Organizations facing such incidents are often required to follow strict protocols regarding when and how they notify affected individuals and authorities.

The Play group is known for utilizing double-extortion tactics. In these scenarios, attackers do not merely encrypt a company's systems to disrupt operations; they also steal sensitive data to threaten its public release. This dual approach increases the pressure on the victim, as the threat of exposing confidential information can be more damaging than the operational downtime caused by encryption. The stolen data could potentially be utilized by the group for secondary attacks or highly targeted phishing campaigns against the individuals whose information was compromised.

The Play group has been active since 2022 and is noted for a relatively closed operational style. This characteristic can make it difficult for security researchers to analyze the technical specifics of their attacks, as they tend to maintain a higher level of operational security. For organizations in the manufacturing sector, such incidents highlight the importance of robust defensive measures, including strict access controls, comprehensive monitoring, and regular security audits to mitigate the risk of unauthorized data exfiltration.