Poly targeted by Play ransomware group in alleged data breach

• Ransomware group: Play
• Country: United States
• Sector: Technology
• Announcement date: May 22, 2023

Play ransomware group claims to have stolen data from Poly

The Play ransomware group has listed a leak announcement on their dedicated leak site, targeting the technology company Poly. According to the claim made by the group on May 22, 2023, they have successfully obtained a significant volume of information from the organization's systems. The group alleges that the total size of the exfiltrated data amounts to 600 GB.

This incident follows a pattern observed in modern cyberattacks where threat actors focus on data theft rather than just system encryption. The announcement made by the group provides specific details regarding the nature of the alleged breach and the types of information they claim to have accessed. While the group has made these claims publicly on their platform, the incident highlights the ongoing risks faced by large-scale technology organizations in the current threat landscape.

Details of the alleged data exfiltration

The announcement made by the Play group on May 22, 2023, includes specific details regarding the scope of the operation. The group claims to have targeted the organization's internal systems to extract a wide variety of sensitive information. The listing describes the data as being highly sensitive, encompassing both corporate and personal information that could be used for various malicious purposes.

According to the group's claims, the leaked data includes a range of confidential documents and personal identifiers. The specific types of data mentioned in the announcement include:

• Employee personal data
• Social Security Numbers (SSN)
• Identity documents
• Passport information
• Financial data

The presence of such highly sensitive identifiers, such as Social Security Numbers and passport information, significantly increases the potential impact of the breach. Such data is often highly sought after by cybercriminals for identity theft and other fraudulent activities.

About Poly

Poly is a technology company that specializes in the development of audio and video conferencing solutions, headsets, and various collaboration technologies. The company plays a significant role in the technology sector by providing tools that facilitate communication and teamwork. It is important to note that Poly was acquired by HP in 2022, integrating its specialized communication technologies into the broader HP ecosystem.

Analysis and potential impact of the incident

The Play group is recognized as a ransomware entity that utilizes double-extortion tactics. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. They threaten to leak this stolen data on public forums or dark web marketplaces if a ransom demand is not met. This tactic increases the pressure on organizations, as the threat of data exposure can lead to significant reputational and legal consequences even if systems are restored from backups.

The sensitivity of the data claimed to be stolen—including financial records and personal identification—poses secondary risks to the affected parties. These risks include identity theft and the potential for highly targeted phishing attacks directed at employees and stakeholders. Because the organization is based in the United States, this incident may trigger legal proceedings under various state laws and federal data protection regulations regarding the handling of sensitive personal information.

Based on the known modus operandi of the Play group, there is a possibility that the exfiltrated data could be fully disclosed to the public or sold on the black market if the group's demands are not satisfied. For organizations in the technology sector, such incidents underscore the necessity of robust data protection strategies, including strict access controls, continuous monitoring of network traffic for unusual data transfers, and comprehensive encryption of sensitive data at rest and in transit to mitigate the impact of potential exfiltration.