Record Go Alquiler Listed by play Ransomware Group: What Was Exposed & What To Do

Ransomware groups continue to pressure organisations by pairing encryption with data theft and public leak-site listings, a pattern that has become routine across Europe and beyond. In this climate, even a single listing can leave customers and partners uncertain about what, if anything, has left an organisation’s systems.

On 23 July 2026, the ransomware group known as play listed Record Go Alquiler, a Spanish firm, claiming that internal files had been exfiltrated in a ransomware attack. The number of people affected remains unknown, and public detail beyond the group’s claim is limited. For anyone who has rented a vehicle or otherwise dealt with the company, the listing raises practical questions about personal data and next steps.

Inside the incident

Public reporting states that Record Go Alquiler was listed by the play ransomware group on 23 July 2026. The group claims that internal files were exfiltrated as part of a ransomware attack. No confirmed figure for the number of people affected has been released, and the precise timing of any intrusion, the initial access method, and the full scope of systems involved have not been disclosed in the available record.

What is known is confined to the leak-site claim itself and the geographic note that the organisation is based in Spain. There is no public confirmation from the company in the supplied facts that would independently verify the volume of data taken or the success of any encryption component. Until further official detail emerges, the incident rests on the group’s assertion that internal files left the network.

Who is play?

Play is a ransomware operation that has been active for several years and is documented for using double-extortion tactics: encrypting systems while also stealing data, then threatening to publish the material on a dedicated leak site if a ransom is not paid. The group typically gains initial access through common vectors such as compromised credentials, exposed remote services, or phishing, then moves laterally before deploying its ransomware and exfiltration tools.

Play has previously listed organisations across multiple sectors and countries, often posting sample files or directory listings to pressure victims. In this case, the group’s listing of Record Go Alquiler constitutes a claim that internal files were taken; it should be treated as an unverified assertion unless and until the organisation or independent investigators confirm the details. No specific statements by play about this victim beyond the listing itself appear in the available facts.

About Record Go Alquiler

Record Go Alquiler operates in Spain in the vehicle-rental sector. Companies of this type routinely manage bookings, customer identity documents, driving-licence details, contact information, payment card or billing data, and internal operational records such as contracts, fleet information, and staff files. Because rentals often require strong identity verification, these organisations tend to hold relatively sensitive personal data compared with many other consumer services.

A breach affecting such a firm is consequential precisely because of that data concentration. Customers, corporate clients, and employees may all have records stored in the same environment. Even when the exact contents of a claimed exfiltration remain unconfirmed, the sector profile alone explains why a listing attracts attention from both affected individuals and regulators.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of data types—such as customer databases, financial records, or employee files—has been publicly named. Exact contents therefore remain unconfirmed.

Organisations in the car-rental sector typically hold customer names, addresses, phone numbers, email addresses, copies or details of identity and driving documents, reservation histories, and payment-related information, along with internal business documents. It is reasonable to expect that some mixture of these categories could be present among “internal files,” yet it would be inaccurate to assert that any specific category was taken. Readers should treat the exposure as limited to the general description given by the listing until more precise inventories are released.

Why it matters

For individuals, the practical risks centre on misuse of personal details that may have been stored by a rental company: targeted phishing that references a real booking, identity-related fraud if document scans were among the files, or unwanted contact using verified phone numbers and emails. Even without confirmed payment-card data, the combination of identity and contact information can support social-engineering attempts.

For the organisation, a public ransomware listing can disrupt operations, trigger regulatory notification duties under European data-protection rules, and erode trust among customers and partners. Recovery costs, forensic work, and potential contractual obligations add further pressure. Because the number of people affected is unknown, the scale of any downstream harm cannot yet be measured; the absence of that figure itself prolongs uncertainty for anyone who has done business with the firm.

Were you affected?

If you have rented from Record Go Alquiler or supplied personal documents to the company, treat the listing as a prompt to review your exposure rather than as proof that your own data was taken. Monitor bank and card statements for unfamiliar charges, be alert to phishing messages that mention vehicle rentals or Spanish bookings, and consider placing fraud alerts with relevant credit or identity services if you provided official identity documents. Change passwords on any accounts that reused credentials associated with the rental, and enable multi-factor authentication where available.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Keep records of any suspicious contact and report confirmed fraud to local authorities and your financial institutions. Further official statements from the company, if they appear, will be the most reliable source for confirming whether specific customer records were involved.

AICompiled with AI assistance from public sources and published under our editorial standards.