FURETANK,SIRIUS SHIPPING,VAS,DONSONET Listed by play Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 27, 2022, the organisations FURETANK, SIRIUS SHIPPING, VAS and DONSONET were listed by the ransomware group known as play. Public reporting places the entities in Sweden within the European Union. What is confirmed so far is limited: the group claims internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further operational details have not been disclosed in available records.

For individuals and partners connected to these shipping-related firms, the listing raises practical questions about what information may have left their systems and how that exposure could be used. This account sticks to the recorded facts and established public background on the actor and sector.

Breaking down the breach

According to the available record, the incident centres on a claim by the play ransomware group that it listed FURETANK, SIRIUS SHIPPING, VAS and DONSONET after a ransomware attack in which internal files were exfiltrated. The listing was reported on December 27, 2022. No confirmed figure for the number of people affected has been published. The precise method of initial access, the duration of any intrusion, the volume of data taken, and whether encryption was also deployed are not detailed in the public summary. The organisations are associated with Sweden and the wider EU. Beyond the group’s claim of exfiltrated internal files, no independent verification of the full scope or contents has been supplied in the facts at hand. In short, the core public signal is the leak-site listing itself and the stated category of data.

The group behind it: play

Play is a ransomware operation that has been active in the public domain for some time and is generally associated with double-extortion tactics. In this model, operators typically claim to steal data before or alongside encryption and then threaten to publish material on a dedicated leak site if their demands are not met. The group has previously listed a range of organisations across multiple sectors and geographies, using the visibility of those listings as pressure. Public reporting on play commonly notes the use of phishing, exploitation of exposed remote services, and living-off-the-land techniques, though the specific entry point in any given case is often not confirmed by victims. With respect to FURETANK, SIRIUS SHIPPING, VAS and DONSONET, the only direct assertion in the record is the group’s own listing and its claim that internal files were exfiltrated; no further statements attributed to play about these particular entities are included in the facts. As with other ransomware claims, the listing should be treated as an unverified assertion until corroborated by the organisations or independent investigation.

About FURETANK,SIRIUS SHIPPING,VAS,DONSONET

FURETANK, SIRIUS SHIPPING, VAS and DONSONET appear in the record as related or co-listed entities operating in the maritime and shipping domain, with a reported footprint in Sweden and the European Union. Companies of this type typically manage vessel operations, cargo logistics, crewing, technical maintenance and commercial contracts. They routinely hold operational schedules, customer and supplier records, employee and crew data, financial documentation, and technical or safety-related files required for compliance with maritime and EU regulations. A breach affecting such organisations is consequential because shipping firms sit at the intersection of physical trade, international supply chains and regulated personal and commercial data. Disruption or exposure can affect not only the companies themselves but also charterers, ports, insurers and individuals whose details appear in crew lists, payroll or customer systems. Public detail on the exact corporate structure linking these four names is limited in the breach record, so they are treated here as the organisations named in the listing.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory—such as specific categories of personal data, financial records, or technical documents—has been disclosed. The number of individuals potentially affected is unknown. Organisations in the shipping sector commonly store employee and crew personal information, contact details for commercial partners, voyage and cargo data, contracts, invoices and internal correspondence. It is reasonable to note that such material is typical of the industry, yet it remains unconfirmed whether any particular subset was among the files the group claims to have taken. Readers should therefore treat the exposed data as “internal files” only, with the exact contents unverified in public reporting.

Why it matters

When internal files leave an organisation under ransomware conditions, the practical risks are concrete even if the full inventory is unknown. Individuals whose names, contact details, identification numbers or employment records appear in those files may face phishing, social-engineering attempts or identity misuse if the material is later circulated. Commercial partners can see sensitive contract or pricing information exposed, which may affect negotiations or competitive position. For the organisations themselves, the incident can bring regulatory scrutiny under EU data-protection rules, notification duties, potential contractual disputes and the operational cost of investigation and remediation. Because the scale and precise contents remain undisclosed, the severity for any single person cannot be quantified from the public record; the prudent stance is to assume that relevant internal material may have been copied and to monitor for secondary misuse. The listing by a known ransomware group also signals that the data, if genuine, could be published or sold, extending the window of risk beyond the initial intrusion.

Were you affected?

If you have worked for, contracted with, or supplied personal or commercial information to FURETANK, SIRIUS SHIPPING, VAS or DONSONET, treat the possibility of exposure seriously until more detail emerges. Practical first steps include watching for unexpected emails or calls that reference the companies or your relationship with them, enabling multi-factor authentication on important accounts, and reviewing bank and credit activity for unfamiliar transactions. Consider placing fraud alerts where available in your jurisdiction. Because the exact data types and affected population are not confirmed, a cautious approach is warranted rather than panic. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets, which provides one additional data point while official notifications, if any, are still pending.

AICompiled with AI assistance from public sources and published under our editorial standards.