Perry-McCall Construction listed on Play ransomware leak site

• Ransomware group: Play
• Country: United States
• Sector: Professional Services
• Announcement date: February 6, 2024

Play ransomware group claims data breach at Perry-McCall Construction

The Play ransomware group has listed Perry-McCall Construction on its dedicated leak site, claiming to have successfully obtained the company's data. This announcement, made on February 6, 2024, marks a significant escalation in the threat posed by the group against the organization. While the group has claimed to have access to sensitive information, the incident remains an allegation by the threat actor.

The group alleges that the breach involves data specifically related to the company's commercial construction projects. To increase pressure on the target, the Play group has initiated a countdown timer on their leak site, which serves as a warning for the potential public release of the stolen files. This tactic is a hallmark of modern ransomware operations, designed to create a sense of urgency and panic during negotiations.

Alleged data types and information involved

According to the announcement made by the threat actors, the leaked data allegedly contains a wide range of sensitive and confidential information. The scope of the alleged theft is extensive, covering various aspects of the company's operations and internal documentation. The information reportedly includes:

• Client documents
• Budget data
• Payroll records
• Identification documents
• Project files
• Tax records
• Insurance information
• Financial data

The presence of such diverse data types suggests that the attackers may have gained access to multiple internal systems, ranging from administrative and human resources departments to project management and financial databases.

About Perry-McCall Construction

Perry-McCall Construction is a firm based in Florida that specializes in general contracting and construction management. The company provides specialized services tailored to commercial, industrial, and institutional projects. Given the nature of their business, the company manages complex logistics, large-scale budgets, and significant amounts of sensitive client and project-related documentation.

Impact and risks of the alleged breach

This alleged breach by the Play group carries significant risks for the company, its employees, and its clients. The potential exposure of personal and financial information increases the risk of identity theft and financial fraud for individuals associated with the organization. Furthermore, because the entity is based in the United States, the incident may result in legal consequences under state-level data protection laws and specific industry regulations.

The group's use of double-extortion tactics—where data is both encrypted and stolen to be used as leverage—could lead to substantial reputational damage and the exposure of sensitive trade secrets if the data is published. Such an event can undermine the trust that clients and partners place in a construction management firm.

Additionally, the leaked financial and personal information may serve as a foundation for targeted phishing attacks against other stakeholders within the company's supply chain. When attackers possess detailed project and financial data, they can craft highly convincing social engineering campaigns to target vendors, subcontractors, or clients.

In general, organizations in the professional services and construction sectors can mitigate these risks by implementing robust security frameworks. This includes maintaining strict access controls, conducting regular security awareness training for employees, and ensuring that all sensitive data, especially financial and personal records, is encrypted both at rest and in transit. Furthermore, maintaining comprehensive backups and a well-tested incident response plan is essential for managing the fallout of such an event.