Play ransomware group lists Durand-Wayland on leak site

• Ransomware group: Play
• Country: United States
• Sector: Manufacturing
• Announcement date: May 12, 2026

The Play ransomware group has officially listed the American manufacturing company Durand-Wayland on its dedicated leak site. Through this announcement, the threat actor group claims to have successfully exfiltrated private and confidential data belonging to the organization, signaling a potential significant data breach involving the firm's sensitive internal and external information.

The details of the claim

According to the announcement published on the group's leak site on May 12, 2026, the Play group has identified Durand-Wayland as their latest victim. The group asserts that they have gained unauthorized access to the organization's systems and have stolen various types of confidential information. While the group's post indicates that a countdown process has been initiated for the public release of the stolen data, the specific timeline for this publication remains tied to the group's internal mechanisms.

The group's operational history is characterized by a closed and secretive style, which often makes it difficult for security researchers and the affected organizations to fully assess the total scope and impact of a breach. This lack of transparency is a common trait among sophisticated ransomware operations, complicating the incident response and forensic investigation processes for the victim.

Compromised data types

The announcement made by the Play group specifies a wide range of sensitive information that has allegedly been compromised during the attack. The group claims to have obtained various documents and records that could be used for malicious purposes. The specific categories of data mentioned in the leak site posting include:

• Client documents
• Budget records
• Payroll information
• IDs
• Tax records
• Financial information

The inclusion of such diverse data types—ranging from personal identification and payroll details to corporate financial and tax records—suggests a deep level of access into the organization's administrative and financial systems.

About Durand-Wayland

Durand-Wayland is an American company operating within the manufacturing sector. The organization specializes in the design and production of automated processing, grading, and packing equipment specifically tailored for the fruit and vegetable packing industry. By providing advanced technological solutions for the agricultural sector, the company plays a role in the technological infrastructure of food production and distribution chains.

Risk assessment and industry implications

The Play ransomware group, which has been active since 2022, is well-known for its use of double extortion tactics. In such scenarios, attackers do not merely encrypt an organization's data to demand a ransom for decryption; they also steal sensitive information and threaten to leak it publicly to increase the pressure on the victim to pay. This method significantly elevates the risk profile of the incident, as the threat of data exposure creates long-term consequences even if systems are successfully restored.

For an organization like Durand-Wayland, the potential exposure of this data poses several secondary risks. The theft of IDs, payroll information, and tax records can lead to identity theft and highly targeted phishing attacks directed at both employees and clients. Furthermore, because the organization is based in the United States, this breach may trigger complex legal consequences under various state-level data protection laws and federal regulations regarding the handling of sensitive information.

The potential impact of this incident also extends to supply chain security. Given that the company provides essential technological solutions for the agricultural sector, a breach involving financial and personal data could create ripple effects across the supply chain. Organizations in the manufacturing and agricultural technology sectors can mitigate such risks by implementing robust data protection frameworks, enforcing strict access controls, and maintaining comprehensive monitoring to detect unauthorized exfiltration attempts early in the attack lifecycle.