UJV Rez Listed by play Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 7 December 2022, the Czech nuclear research organisation UJV Rez appeared on the leak site operated by the ransomware group known as play. The group claims to have stolen internal data in a ransomware attack. Public detail on the incident remains limited: the number of people affected is unknown, and no independent confirmation of the claimed theft has been widely reported.

Listings of this kind are assertions by the attackers rather than verified disclosures. What is established so far is only that UJV Rez was named on the play site and that the group states internal files were exfiltrated. For an organisation working in nuclear research and related technical fields, even an unconfirmed claim of internal-file exposure raises clear questions about operational and personal data security.

Inside the incident

According to the available record, UJV Rez was listed by the play ransomware group on or around 7 December 2022. The group’s public claim is that it carried out a ransomware attack and exfiltrated internal files. No further technical particulars—such as the initial access method, the duration of any intrusion, the volume of data taken, or whether systems were encrypted—have been disclosed in the material at hand.

The number of individuals potentially affected is recorded as unknown. There is likewise no public confirmation in the given facts of whether negotiations occurred, whether a ransom was paid, or whether any data was subsequently released. The incident is therefore known primarily through the leak-site listing itself, which must be treated as an unverified claim by the threat actor.

The group behind it: play

Play is a ransomware operation that has been active in the public record since at least 2022. Like many contemporary ransomware groups, it is associated with a double-extortion model: encrypting victim systems while also copying data and threatening to publish it on a dedicated leak site if payment is not made. The group has listed organisations across multiple sectors and countries, typically posting sample files or directories to support its claims.

Play’s listings are marketing and pressure tools. They do not by themselves prove the full scope or accuracy of what was taken. In this case, the facts state only that UJV Rez was listed and that the group claims to have stolen internal data. No additional statements attributed to play about this specific victim—such as file counts, ransom demands, or deadlines—are provided in the record, and none should be assumed.

Who is UJV Rez?

UJV Rez (ÚJV Řež) is a research and engineering organisation based in the Czech Republic with a long-standing focus on nuclear energy, reactor technology, radioactive-waste management, and related scientific and industrial services. Organisations of this type routinely handle technical documentation, research data, project files, supplier and partner information, and internal administrative records. They may also process personal data of employees, contractors, and collaborators.

Because nuclear research sits at the intersection of energy infrastructure, safety regulation, and specialised intellectual property, a breach affecting such an entity is consequential beyond ordinary commercial data loss. Even when the precise contents of any stolen material remain unconfirmed, the mere possibility that internal files left the organisation’s control creates operational, regulatory, and reputational considerations for the institution and for anyone whose information may have been among those files.

The information in question

The facts identify the exposed material only as “internal files exfiltrated in [a] ransomware attack.” No inventory of specific data categories—such as employee records, research datasets, contracts, or credentials—has been published in the available record. The exact contents therefore remain unconfirmed.

Organisations engaged in nuclear research and engineering typically hold a mix of technical reports, design and safety documentation, project correspondence, financial and procurement records, and ordinary corporate data including staff and contractor details. Whether any of those categories were among the files play claims to have taken is not established by the public facts. Readers should treat descriptions of the data as limited to the group’s general claim of internal-file theft.

Why it matters

For individuals, the practical risk depends entirely on what, if anything, was actually taken. If personnel or contact data were included, possible consequences include targeted phishing, social-engineering attempts that reference genuine internal details, or longer-term misuse of personal identifiers. If only technical or administrative files were involved, direct personal harm may be lower, yet residual exposure of names, emails, or project affiliations can still enable convincing fraud.

For UJV Rez itself, an asserted ransomware incident raises questions of operational continuity, the integrity of research and safety-related information, and compliance with data-protection and sector-specific security expectations. Because the scale and contents are undisclosed, the organisation and any affected parties must proceed on the cautious assumption that internal material may have left its control, while recognising that the claim originates with the attackers and has not been independently detailed in the given facts.

If your data was in this claimed breach

If you have a past or present connection to UJV Rez—as an employee, contractor, partner, or correspondent—treat the possibility of exposure seriously until more is known. Monitor financial and email accounts for unusual activity, be sceptical of unexpected messages that reference the organisation or its projects, and consider changing passwords on any accounts that may have shared credentials or recovery information with workplace systems. Enable multi-factor authentication wherever it is available.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step will not confirm or rule out involvement in this specific incident, but it can indicate whether your address is circulating in other compromised collections and help you prioritise further precautions.

AICompiled with AI assistance from public sources and published under our editorial standards.