RFI targeted by Play ransomware group in alleged data breach

• Ransomware group: Play
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: September 15, 2025

Play ransomware group claims data breach at RFI

The Play ransomware group has officially listed the United States-based organization RFI on its dedicated leak site. According to the announcement made on September 15, 2025, the threat actors claim to have successfully infiltrated the organization's network. This breach involves the alleged theft of various types of sensitive information, which the group intends to publish. The announcement notably included a countdown timer, a common tactic used by ransomware groups to increase pressure on their targets by setting a deadline for the public release of stolen files.

This incident follows an alleged initial access date of September 5, 2025. While the group has made these claims publicly, the exact volume of the stolen data and the specific number of files compromised have not been disclosed in the announcement. Furthermore, no specific ransom demand has been made public by the group in relation to this specific target.

Alleged compromised data and information types

The threat actors have provided a detailed list of the categories of information they claim to have exfiltrated from RFI's systems. The group asserts that the breach includes highly sensitive and confidential documentation that could impact the organization's internal operations and its relationship with external partners. The alleged stolen data encompasses a wide range of administrative, financial, and personal records.

The specific types of data claimed to be involved in the breach include:

• Client documents
• Payroll data
• Accounting records
• Tax documents
• IDs
• Financial information

The inclusion of such diverse data types suggests a broad compromise of the organization's digital environment, potentially touching upon multiple departments from human resources to finance and client management.

About RFI

RFI Ingredients is a company based in the United States that operates within the agriculture and food production sector. The firm specializes in the supply of natural ingredients, botanical extracts, and functional food components. These products serve various industries, including the food, beverage, and dietary supplement markets. RFI Ingredients focuses on providing innovative ingredient solutions, specifically catering to the needs of the health and wellness market.

Analysis and broader implications of the attack

The Play ransomware group is known for employing double-extortion tactics. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak confidential information on public leak sites, the group exerts significant psychological and reputational pressure on the victim to meet ransom demands. This method is particularly effective because even if an organization can restore its systems from backups, the threat of a public data leak remains a potent weapon for the attackers.

The nature of the data claimed to be stolen—including IDs, payroll, and financial records—poses significant secondary risks. For the organization's employees and clients, the exposure of such information can lead to identity theft or highly targeted phishing attacks. For the organization itself, a breach of this nature can result in severe operational and financial disruptions. Given that RFI is based in the United States, such an incident may trigger investigations by regulatory bodies and scrutiny under various state-level data protection laws.

Furthermore, the disruption of financial and operational processes can have a cascading effect on the supply chain, especially for a company providing essential components to the food and wellness industries. The closed operational style of groups like Play often makes it difficult for security professionals to fully assess the specific attack vectors used or the true scope of the leak. To defend against such threats, organizations typically focus on robust network segmentation, strict access controls, and continuous monitoring to detect unauthorized movement within the network.