RHI Supply listed on Play ransomware leak site

• Ransomware group: Play
• Country: United States
• Sector: Manufacturing
• Announcement date: August 9, 2025

Play ransomware group claims attack on RHI Supply

The threat actor known as Play has listed RHI Supply on its leak site, alleging that the organization's data has been compromised. According to the announcement made on the group's platform, the breach is linked to an attack that the group claims occurred on August 4, 2025. The listing was officially posted on August 9, 2025.

The group has initiated a countdown process for the publication of the data, a common tactic used by ransomware operators to apply psychological pressure on their victims. This pressure is designed to force the target organization into meeting ransom demands by creating a sense of urgency regarding the imminent public exposure of sensitive information.

Claimed data types and contents

According to the information provided in the post, the leaked data is claimed to include a wide variety of private and confidential information. The threat actor asserts that the stolen datasets contain sensitive documentation that could impact various levels of the organization's operations.

The specific types of data claimed to be involved include:

• Client documents
• Budget data
• Payroll data
• Accounting records
• Tax documents
• Identification information
• Financial records

No information was provided regarding the total size of the data or the specific file count involved in this incident.

About RHI Supply

RHI Supply is a manufacturing and supply company based in the United States. The organization operates in the field of industrial equipment and various manufacturing materials.

Analysis and potential impact

If these claims are verified, it is assessed that employees and clients of RHI Supply may face risks of identity theft. The nature of the exposed data may trigger data breach notification requirements and legal obligations under relevant US state laws. Given the Play group's double-extortion methodology, it is anticipated that the leaked data could be utilized in secondary attacks or targeted phishing campaigns.

Ransomware groups often employ double-extortion tactics, where they not only encrypt an organization's systems but also steal sensitive data to use as leverage. By threatening to leak this information, attackers aim to maximize their chances of receiving payment. This stolen data, particularly when it includes identification and financial records, can be repurposed by threat actors for various malicious activities, such as social engineering or identity fraud.

The Play group is known to be a relatively closed entity operating since 2022, which may suggest that negotiation processes could be challenging. The group's operational style often involves high levels of secrecy, making it difficult for victims to engage in effective communication or recovery efforts through traditional channels.

For organizations in the manufacturing and supply sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Protecting sensitive client documents, payroll information, and financial records is essential to maintaining operational integrity and legal compliance. Defensive strategies typically include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access through phishing or other common vectors.