Play ransomware group lists DHM Properties data on leak site

• Ransomware group: Play
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: September 22, 2025

The Play ransomware group has listed data allegedly belonging to DHM Properties on their dedicated leak site. According to the announcement made on September 22, 2025, the threat actor claims to have successfully breached the organization's systems. This development follows a period of unauthorized access that the group asserts began on September 17, 2025.

Details of the claimed attack

The threat actor known as Play has posted an announcement on their leak platform regarding the breach of DHM Properties. The group claims to have gained access to the organization's internal systems on September 17, 2025. Following the initial intrusion, the group published a notice on September 22, 2025, which included a countdown timer designed to pressure the victim by signaling the upcoming public release of the stolen information.

Ransomware leak sites serve as a primary tool for extortion in modern cyberattacks. These platforms are used by threat actors to host lists of victims and, in many cases, provide samples of stolen data to prove the validity of the breach. By using countdown timers, these groups create a sense of urgency, aiming to force the victim into compliance with ransom demands through the psychological pressure of imminent data exposure.

Data allegedly exfiltrated by the group

The announcement made by the Play group claims the exfiltration of a wide variety of sensitive and confidential information. The group asserts that the stolen data includes private and personal confidential information, which could have significant implications for the individuals involved. The specific categories of data mentioned in the claim include:

• Client documents
• Payroll data
• Accounting records
• Tax information
• IDs
• Financial information

The inclusion of such diverse datasets—ranging from personal identification to sensitive financial and tax records—highlights the potential severity of the breach. When personal identifiers and financial documents are compromised, it significantly increases the risk of identity theft and various forms of fraud targeting the individuals whose information was stored by the organization.

Organization profile

DHM Properties is a real estate and property management company based in the United States. The company provides residential leasing and property management services, making it a custodian of sensitive client and tenant information.

Impact and potential consequences

This leak may pose significant risks of identity theft and fraud for the organization's employees and customers. Because the organization is based in the United States, the incident may lead to legal repercussions under state-level data protection laws and federal regulations. The exposure of such a broad range of financial and personal data could potentially create negative impacts on the supply chain and lead to significant reputational damage for the company.

The Play group is known for utilizing double extortion tactics. This methodology involves both encrypting the victim's systems to disrupt operations and stealing sensitive data to leak online. This dual approach is designed to maximize leverage, as the threat actor can threaten the victim with both operational downtime and the public exposure of confidential information.

For organizations in the real estate and property management sector, maintaining robust cybersecurity defenses is critical due to the high value of the personal and financial data they manage. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to prevent initial access through phishing or other common vectors.