Morrison Companies listed on Play ransomware leak site

• Ransomware group: Play
• Country: United States
• Sector: Hospitality
• Announcement date: July 16, 2025

Play ransomware group claims attack on Morrison Companies

The ransomware group known as Play has listed Morrison Companies on its dedicated leak site. According to the announcement, the threat actors claim to have successfully gained access to the organization's data. This listing was discovered on July 16, 2025, although the group reports that the actual attack occurred much earlier, on March 6, 2024.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. By publishing the names of targeted organizations, these groups aim to increase the likelihood of receiving a ransom payment through public exposure. Such tactics are a hallmark of modern cyber extortion, where the threat of data exposure is used as a primary leverage tool against the victimized entity.

Details of the claimed breach

While the Play group has officially announced the listing of Morrison Companies, specific details regarding the breach remain limited. At this time, there is no information available regarding the nature of the leaked data. Furthermore, the group has not provided details regarding the total file count or the specific size of the data allegedly exfiltrated. No ransom demand has been publicly specified in the current announcement.

The listing names no specific data types that have been compromised. Additionally, attempts to view the evidence via screenshots were unsuccessful as the content failed to load, leaving the exact contents of the alleged breach unverified through visual means.

About Morrison Companies

Morrison Companies is a United States-based organization. The company primarily operates within the hospitality and real estate development sectors, managing diverse interests across these two major industries.

Analysis and potential implications

The Play group is recognized for employing double extortion tactics. This methodology involves two distinct layers of pressure: the encryption of an organization's systems to disrupt operations and the exfiltration of sensitive data to be used for blackmail. This suggests that the organization may face the risk of data encryption as well as data exfiltration. When an attacker utilizes double extortion, the organization must defend against both the immediate operational downtime caused by locked systems and the long-term reputational and legal risks associated with the exposure of private information.

As a United States-based entity, a potential data breach could trigger notification obligations under state laws and federal regulations. Depending on the nature of the information involved, organizations are often legally required to inform affected individuals and regulatory bodies within specific timeframes. Beyond legal compliance, secondary risks may emerge for employees and customers, such as the threat of identity theft or the occurrence of targeted phishing attacks using the stolen information.

The closed operational nature of the Play group may complicate the assessment of the breach's scope and could impact the organization's operational continuity. For organizations operating in the hospitality and real estate sectors, maintaining continuity is vital for client trust and service delivery. General defensive strategies for organizations facing such threats typically include implementing robust multi-factor authentication, maintaining offline backups of critical data, and conducting regular security awareness training to mitigate the risk of initial access through phishing.