Eastman Cooke Listed by play Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 25, 2025, the Play ransomware group listed Eastman Cooke on its leak site and claimed responsibility for a ransomware attack that included the exfiltration of internal files. The number of people whose information may be involved is not known, and no further details about the scope or timing of the incident have been made public. This listing means that any records held by the organization could now circulate beyond its control, creating direct consequences for individuals whose details appear in those files.

What happened

The incident centers on a claim by the Play ransomware group that it targeted Eastman Cooke, a United States organization. According to the listing, internal files were taken during a ransomware operation. No confirmation of the attack has been issued by Eastman Cooke, and the date of the intrusion itself has not been disclosed. The number of records involved and the precise method of initial access remain unknown.

Who is play?

Play is a ransomware group that has operated since at least 2022. It typically gains access to corporate networks through common entry points such as remote desktop services or unpatched systems, then deploys encryption while also copying data. The group maintains a leak site where it lists organizations that have not paid demanded ransoms and publishes samples of stolen material. Its activity has been documented across multiple countries, with a focus on mid-sized and larger entities in North America and Europe.

About Eastman Cooke

Eastman Cooke is an organization based in the United States. Entities of this type routinely maintain records connected to their operations, including communications, contracts, employee information, and client or project documentation. A successful intrusion that results in data removal therefore carries implications for the confidentiality of those records and for the individuals or partners referenced in them.

What data was at risk

The only detail provided is that internal files were allegedly exfiltrated. The specific categories of information contained in those files have not been disclosed. Organizations in this sector commonly store employee records, financial documents, and correspondence, but the exact contents of the material taken in this case are unconfirmed.

What's at stake

For individuals, the main concern is that personal or professional details appearing in the files could be used for targeted fraud, account takeovers, or further social-engineering attempts. For the organization, the exposure of internal documents can complicate ongoing business relationships and regulatory compliance obligations. Because the volume and sensitivity of the data remain unspecified, the full extent of these risks cannot yet be measured.

What to do if you're exposed

Anyone who has had dealings with Eastman Cooke should watch for unusual account activity and consider placing fraud alerts with credit agencies. Changing passwords for any associated accounts and enabling multi-factor authentication where available are immediate steps that limit further misuse. Readers can also run a free exposure scan of their email address to check whether their information has appeared in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.