Nelligan White Architects listed on Play ransomware leak site

• Ransomware group: Play
• Country: United States
• Sector: Professional Services
• Announcement date: October 21, 2025

Play ransomware group claims attack on Nelligan White Architects

The threat actor known as Play has listed the United States-based architecture firm Nelligan White Architects on its dedicated leak site. According to the announcement made by the group, the organization has been targeted in a cyberattack, and the group is threatening to leak the organization's data if their demands are not met.

The listing appeared on the group's leak site on October 21, 2025. Based on the information provided by the threat actor, the initial compromise or attack is claimed to have occurred on October 8, 2025. This timeline suggests a period of activity between the initial intrusion and the public announcement on the leak site.

Details of the claimed incident

The Play ransomware group has claimed to have compromised data belonging to Nelligan White Architects. While the group has officially listed the organization on its platform, the specific nature and volume of the data allegedly compromised have not been disclosed by the attackers. The listing does not provide information regarding the total size of the data or the specific number of files involved in the incident.

Regarding the specific categories of information that may have been targeted, the current listing names no specific data types.

About Nelligan White Architects

Nelligan White Architects is an architecture and design firm based in New York. The company provides architectural planning, design, and project management services for various scales of projects.

Risk assessment and industry implications

The Play group has been active since 2022 and is recognized for employing double-extortion tactics. In a double-extortion scheme, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage, threatening to publish it online to pressure the victim into paying a ransom.

As the organization operates in the architecture and design sector, it is possible that sensitive intellectual property and project-related data may be at risk. The exposure of such information can have significant consequences for professional services firms. Furthermore, given the organization's location in the United States, any potential data breach may trigger legal proceedings under state-level data protection laws and regulations.

The potential exposure of employee or client information could lead to secondary risks such as identity theft and targeted phishing attacks. When sensitive personal or professional information is leaked, it often becomes a resource for other malicious actors to conduct more sophisticated social engineering campaigns against the individuals involved or the organization itself.

In general, organizations facing such threats often focus on defensive measures such as maintaining robust backup systems, implementing multi-factor authentication, and conducting regular security awareness training to mitigate the risks of initial access and subsequent data exfiltration.