Sellars Absorbent Materials targeted by Play ransomware group

• Ransomware group: Play
• Country: United States
• Sector: Manufacturing
• Announcement date: November 4, 2025

Play ransomware group claims data exfiltration at Sellars Absorbent Materials

The ransomware group known as Play has listed the American manufacturing firm Sellars Absorbent Materials on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully gained unauthorized access to the organization's internal systems. This breach has reportedly resulted in the exfiltration of various types of confidential information, which the group intends to use as leverage.

The threat group has set a deadline for the publication of the stolen information. According to the claims made on the leak site, the data is scheduled to be released to the public on November 7, 2025. This follows a claimed attack date of October 28, 2025, suggesting that the attackers had access to the network for a period prior to the public announcement.

Details of the claimed data breach

The Play group has provided specific details regarding the nature of the information they allege to have stolen from the organization. The group claims that the stolen datasets are highly sensitive, containing a mix of corporate and personal information. According to the group's announcement, the compromised data includes the following categories:

• Client documents
• Budget data
• Payroll records
• Identification documents
• Tax records
• Financial information

The inclusion of such diverse data types—ranging from internal financial records to personal identification and payroll details—highlights the broad scope of the alleged intrusion. While the specific volume of the stolen data and the exact number of files involved have not been disclosed by the group, the variety of the categories suggests a significant impact on the organization's data privacy. No information was provided regarding the specific ransom demand or the total size of the data exfiltrated.

About Sellars Absorbent Materials

Sellars Absorbent Materials is an American company based in Milwaukee, Wisconsin. The firm operates within the manufacturing sector and is recognized for producing industrial cleaning products, absorbent wipes, and various paper towel solutions. The company is notably known for its high-performance cleaning products, which are primarily manufactured using recycled materials.

Analysis and potential implications of the attack

The Play group has been active since 2022 and is recognized for employing double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to threaten its public release. This tactic is designed to increase pressure on the victim, as the threat of a data leak can cause significant reputational and legal damage even if the organization can recover its systems from backups.

The potential exposure of the data claimed by the Play group may create significant secondary risks for both the organization's employees and its clients. Specifically, the theft of identification documents, tax records, and payroll information increases the risk of identity theft and makes individuals targets for highly specific, targeted phishing attacks. Furthermore, because the organization is based in the United States, this breach could lead to complex legal consequences under various state-level data protection laws and regulations.

The operational continuity of the organization could be negatively impacted by the disclosure of such sensitive financial and personal data. The group's relatively closed operational style suggests that any negotiation processes regarding the return or non-disclosure of the data may be complex. For organizations in the manufacturing sector, such incidents underscore the importance of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining strict network segmentation to prevent lateral movement, and conducting regular audits of access controls to sensitive financial and personal data repositories.