The Play ransomware group claims to have breached Deatak Inc., an Illinois-based manufacturer specializing in high-quality flammability testing instruments for the aviation, construction, and transportation sectors. The group added the company to its dark web leak site on February 1, 2026, threatening to publish the allegedly exfiltrated data by February 5, 2026, if their demands are not met.
According to the actor, the compromised data includes:
-
Private and personal confidential data
-
Client documents
-
Budget and payroll records
-
IDs and tax documents
-
Financial information












