Select Tool Listed by play Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 6, 2026, the ransomware group Play listed Select Tool on its leak site. The entry states that internal files were exfiltrated during a ransomware attack against the Canadian organization. No figure has been released for the number of people affected, and no further details on the timing or method of the intrusion have been made public. This development adds to the record of ransomware operations that target organizations and then publicize claims of data theft. The listing itself constitutes the group’s assertion; independent confirmation of the exfiltration volume or contents has not been provided.

Breaking down the breach

Public information on the incident is limited to the March 6, 2026 listing. The group claims to have removed internal files, yet the scale of the data, the date of the intrusion, and the precise techniques used remain undisclosed. No ransom demand amount or payment status has been reported. The organization has not issued a statement confirming or disputing the claims.

Who is play?

Play is a ransomware group that emerged publicly around 2022 and has since conducted operations against entities in multiple countries. Its documented approach involves gaining access to networks, encrypting systems, and exfiltrating data before demanding payment. The group maintains a leak site where it lists organizations it claims to have targeted, a practice known as double extortion. Earlier activity attributed to the group has included attacks on both private companies and public-sector bodies, though specific claims about any single victim require separate verification.

Select Tool and its sector

Select Tool is a Canadian organization. Public records provide little additional detail about its size, operations, or precise industry classification. Companies of this type commonly maintain internal records related to business processes, client interactions, and operational systems. A breach affecting such an entity can expose information that is not ordinarily intended for external release, regardless of the organization’s sector.

What data was at risk

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types, record counts, or specific categories has been released. Organizations in comparable positions routinely hold employee records, financial documentation, correspondence, and technical materials. Without further disclosure, the exact contents cannot be confirmed.

Why it matters

When internal files are removed and later threatened with publication, affected organizations face the possibility that sensitive operational information could become available to unauthorized parties. Individuals whose details appear in those files may encounter risks such as targeted phishing or misuse of personal identifiers. For the organization itself, the incident can lead to investigative costs, regulatory scrutiny, and the need to strengthen access controls and monitoring.

Were you affected?

If you have a professional or commercial relationship with Select Tool, review any communications the company issues about the incident. Monitor accounts for unusual activity and consider placing fraud alerts with credit agencies where applicable. Readers can run a free exposure scan of their email address against known breach data to check whether their information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.