Sheridan Nurseries listed on play ransomware leak site

• Ransomware group: play
• Country: Canada
• Sector: Agriculture and Food Production
• Announcement date: February 3, 2025

The play ransomware group has officially listed the Canadian organization Sheridan Nurseries on its dedicated leak site. This announcement, made on February 3, 2025, suggests that the group has targeted the horticultural company and claims to have successfully exfiltrated data from the organization's systems.

The alleged attack and group claims

According to the announcement posted on the play ransomware group's leak portal, the group claims to have obtained sensitive information belonging to Sheridan Nurseries. While the notice was published on February 3, 2025, the threat actors claim that the actual attack may have taken place as early as January 21, 2025. The publication of this notice on a leak site typically signifies the beginning of a process where the threat actor attempts to pressure the victim by threatening the public release of stolen information.

Ransomware leak sites serve as a platform for cybercriminal groups to host lists of victims. These sites are used to demonstrate the success of an intrusion and to increase pressure on the target organization through public shaming. By listing a company, the group signals that they have moved from the initial intrusion phase to the extortion phase, where the threat of data exposure is used as leverage to demand a ransom.

Information regarding the stolen data

At this stage, there is no detailed information available on the leak site regarding the specific nature or the total scope of the data that was allegedly exfiltrated during the incident. The listing does not provide specifics regarding the volume of files or the specific types of sensitive information contained within the breach.

The listing names no specific data types.

About Sheridan Nurseries

Sheridan Nurseries is a well-established Canadian horticultural and landscaping company. The organization specializes in a wide range of outdoor plants, including trees and shrubs, as well as garden accessories. Their business model operates through a combination of retail garden centers and various wholesale production facilities, serving both individual consumers and larger commercial needs within the landscaping sector.

Potential risks and industry implications

This incident may pose significant risks to the institution's operational continuity and data privacy. Because the play ransomware group is known for employing double-extortion tactics, there is a possibility that the exfiltrated data could be utilized in secondary attacks or identity theft activities. Double extortion is a common ransomware strategy where attackers not only encrypt the victim's systems but also steal sensitive data, threatening to leak it to damage the company's reputation or force payment through the fear of regulatory penalties.

Furthermore, the potential for targeted phishing attacks against the institution's employees and customers may be observed, which could negatively impact the institution's reputation and supply chain security. When customer or employee data is compromised, attackers often use that information to craft highly convincing social engineering campaigns.

As an entity operating in Canada, the confirmation of a data breach could lead to legal obligations under local data protection regulations, such as the Personal Information Protection and Electronic Documents Act (PIPEDA). Organizations in the agriculture and food production sector must remain vigilant against these threats to ensure the integrity of their supply chains and the privacy of their stakeholders.

To defend against such threats, organizations generally focus on robust backup strategies, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Maintaining a strong security posture is essential for protecting operational continuity and meeting the legal requirements of the jurisdictions in which they operate.