Select Tool listed on play ransomware leak site

• Ransomware group: play
• Country: Canada
• Sector: Manufacturing
• Announcement date: March 6, 2026

A data breach claim against Select Tool

The play ransomware group has published a leak announcement claiming to have compromised data belonging to Select Tool, a manufacturing company based in Canada. According to the announcement posted on the group's leak site on March 6, 2026, the group claims to have initiated the attack on March 1, 2026. The listing includes a countdown timer, indicating a scheduled time for the publication of the allegedly stolen data.

The play ransomware group is a known threat actor that has been active since 2022. The group is recognized for its use of double extortion tactics, a method where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage for extortion. In such scenarios, the threat actors threaten to leak the stolen data on public forums if the ransom demands are not met, thereby increasing the pressure on the victimized organization.

Alleged stolen data types

The announcement provided by the play ransomware group claims that the compromised information is extensive and covers various sensitive categories. According to the information provided in the announcement, the leaked data is claimed to include several types of highly sensitive documentation. The specific categories of data mentioned in the claim include:

• Client documents
• Budget data
• Payroll records
• Identification documents
• Tax records
• Financial information

While the group has provided a list of the types of data they claim to possess, no specific information was provided regarding the total size of the data or the exact file count. Additionally, no ransom demand has been disclosed in the current announcement.

About Select Tool

Select Tool is a manufacturing company based in Canada. The organization operates within the industrial equipment sector and provides custom manufacturing solutions. As an entity involved in industrial production and custom solutions, the company manages various operational and administrative data necessary for its business functions.

Impact and potential consequences

The alleged breach suggests that employees and clients of Select Tool may be exposed to significant risks, including the potential for identity theft and fraud due to the nature of the claimed stolen data. Because the organization is located in Canada, this incident may trigger mandatory data breach notification requirements under the Personal Information Protection and Electronic Documents Act (PIPEDA) regulations.

The double extortion strategy employed by the play group could pose a severe threat to the company's operational continuity. Beyond the immediate disruption, the use of leaked data in secondary attacks is a common risk in these scenarios. This situation may result in lasting reputational damage and potential legal sanctions for the organization. It is noted that public information regarding the specific operations and technical details of the play group remains limited.

In general, when organizations in the manufacturing sector face such threats, they must prioritize data protection and incident response. Common defensive steps for organizations include implementing robust backup solutions, maintaining strict access controls, and ensuring regular security audits. Organizations facing potential breaches of sensitive information often must navigate complex regulatory landscapes to ensure compliance with regional privacy laws and to mitigate the impact on their stakeholders.