Play ransomware group claims data breach at Catalanatto & Barnes

• Ransomware group: Play
• Country: United States
• Sector: Professional Services
• Announcement date: February 11, 2026

Play ransomware group claims data breach at Catalanatto & Barnes

The Play ransomware group has listed Catalanatto & Barnes on its leak site, claiming to have obtained sensitive data from the US-based firm. The threat actor claims to have gained access to the organization's systems and exfiltrated various sensitive files, marking a new target for the group.

Details of the alleged attack

According to the information provided by the threat actor, the Play group added Catalanatto & Barnes to its leak site on February 11, 2026, publishing a ransom notice. The group claims to have successfully infiltrated the organization's network and extracted a variety of sensitive files. This incident follows a pattern of activity from the Play group, which has been known for its operations since 2022.

The group is recognized for its use of double-extortion tactics. In a double-extortion scheme, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information before the encryption process begins. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying a ransom. This method increases the pressure on the target, as the risk shifts from mere operational downtime to significant reputational and legal consequences resulting from public data exposure.

Alleged sensitive data involved

Based on the screenshots provided by the attackers, the alleged leaked data includes a wide range of private and confidential documents. The information claimed to be stolen is highly sensitive, potentially impacting both the firm and its clientele. The specific types of data mentioned in the listing include:

• Client documents
• Budget records
• Payroll information
• IDs
• Tax records
• Financial data

While the group has published these claims, no information was provided regarding the total size of the data or the specific file count involved in the breach. Additionally, no ransom demand has been specified in the current listing.

About Catalanatto & Barnes

Catalanatto & Barnes is an accounting and tax consulting firm based in Louisiana, United States. The company provides tax planning, accounting, and financial advisory services to individual and corporate clients. Given the nature of their professional services, the firm handles a significant amount of highly sensitive financial and personal information for its client base.

Risk assessment and organizational implications

Given the nature of the alleged data, there may be significant risks of identity theft and financial fraud for the firm's clients and employees. The exposure of IDs, tax records, and financial data creates a high-risk environment for the individuals involved. Furthermore, as a US-based entity, the organization may face legal consequences under state-level data breach notification laws and relevant regulatory frameworks.

Such an incident could lead to reputational damage and raise concerns regarding supply chain security. Because professional services firms often act as custodians of sensitive data for other businesses, a breach in this sector can have cascading effects on the security posture of their clients. The Play group's relatively closed operational style may indicate that post-incident negotiations could be complex.

For organizations in the professional services sector, maintaining robust security measures is critical. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting thorough employee training to prevent initial access. Organizations must also have a clear incident response plan and a strategy for managing the legal and communicative requirements following a potential data breach to mitigate long-term damage.