Kivells Listed by play Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 16 March 2025 the United Kingdom firm Kivells appeared on a leak site operated by the ransomware group known as play. The group claims that internal files were exfiltrated during a ransomware attack. Public reporting has not stated the number of people affected, the precise timing of the intrusion, or the full scope of material taken, so the picture remains limited to the listing itself and the high-level description of internal files.

For clients, staff and counterparties of a rural-services business, even an unconfirmed claim of data theft raises practical questions about what may have left the organisation and how that information could be misused. The following account stays strictly within the known facts and established public background on the actor and the sector.

Inside the incident

The only concrete public marker is the 16 March 2025 listing of Kivells by play. According to that listing the group asserts that internal files were exfiltrated as part of a ransomware attack. No official confirmation from Kivells has been included in the available record, nor have figures for the volume of data, the date the network was first accessed, or the encryption status of systems been disclosed. The number of individuals whose information may be involved is recorded as unknown. Method of initial access, dwell time, and any ransom demand remain undisclosed. In short, the incident is known solely through the threat actor’s claim that internal files left the organisation.

Inside play

Play is a ransomware operation that has been active for several years and is publicly documented as using a double-extortion model. After gaining access to a network the group typically steals data before deploying encryption, then threatens to publish the stolen material on its leak site if payment is not made. Listings on that site are therefore claims by the group rather than independently verified disclosures. Play has previously targeted organisations across multiple sectors and geographies; its public communications and leak-site posts form the primary source of information about its victims. Nothing in the present record goes beyond the group’s assertion that Kivells’s internal files were taken.

About Kivells

Kivells is a long-established United Kingdom firm operating in the agricultural and rural-property sector. Its activities commonly include livestock and machinery auctions, farm and estate agency work, land agency, and related professional services for farmers, landowners and rural businesses. Organisations of this type routinely hold client contact details, financial records, property and tenancy information, livestock and trading data, and internal administrative files. Because the firm sits at the intersection of personal, commercial and land-related records, any unauthorised removal of internal material can affect both private individuals and the wider rural economy that depends on the firm’s services.

What was likely exposed

The available facts state only that internal files were exfiltrated. No inventory of specific document types, databases or personal-data categories has been published. In the absence of confirmation it is not possible to assert that particular records—such as customer names, bank details, contracts or staff information—were among those taken. Firms in Kivells’s line of work typically maintain precisely those categories of information in the ordinary course of business, yet the exact contents of the claimed exfiltration remain unconfirmed and should be treated as unknown until further verified detail emerges.

What's at stake

If internal files containing personal or commercial data were in fact removed, affected individuals could face risks of targeted phishing, identity fraud or misuse of financial and property information. Counterparties whose contracts or trading records appear in the material might encounter competitive or reputational harm. For the organisation itself the consequences include potential regulatory scrutiny under UK data-protection rules, disruption to day-to-day operations, and the cost of investigation and remediation. Because the scale and precise content remain undisclosed, the actual level of exposure cannot yet be quantified; the prudent stance is to treat the claim as a credible indicator that sensitive material may be in unauthorised hands.

What to do if you're exposed

Anyone who has dealt with Kivells—clients, suppliers, staff or former staff—should monitor bank and credit accounts for unusual activity and be alert to unexpected emails or calls that reference the firm or rural-business details. Change passwords on any accounts that may have shared credentials with systems used in dealings with the company, and enable multi-factor authentication where available. Consider placing a fraud alert with credit-reference agencies. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. If concrete evidence of misuse surfaces, report it promptly to the relevant financial institution and to the UK Information Commissioner’s Office.

AICompiled with AI assistance from public sources and published under our editorial standards.