University Loft Listed by play Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
University Loft has been listed by the play Ransomware Group, with internal files reported to have been exfiltrated in a ransomware attack. The incident was disclosed on 25 November 2025, affecting an undisclosed number of people; anyone connected with the university should check official notices and change passwords or enable additional account protections if advised.
Inside the incident
Public information about the event is limited to the group’s listing. No confirmation has been issued by University Loft regarding the timing of the intrusion, the volume of data taken, or whether any systems were encrypted. The organization has not released a statement on the scope of the incident or any steps taken in response.
Inside play
Play is a ransomware operation that has been publicly active since at least 2022. The group typically uses double-extortion tactics, encrypting systems and copying data before demanding payment. It maintains a leak site where it lists organizations it claims to have compromised. Listings on the site constitute claims by the group rather than independently verified events.
University Loft and its sector
University Loft supplies furniture and related products to higher-education institutions. Organizations in this sector routinely maintain records on customers, suppliers, employees, and institutional contracts. A compromise at such a company can expose business correspondence and operational documents that are not normally public.
The information in question
The listing refers only to “internal files.” No inventory of specific data categories has been published. Companies of this type commonly hold contact details, order histories, financial records, and employee information, but the precise contents of the exfiltrated material remain unconfirmed.
What's at stake
Exposed internal files can contain details that enable targeted fraud or further attacks against partner institutions. For individuals whose information appears in those files, the primary risks are misuse of contact data or credentials. The organization faces potential regulatory scrutiny and costs associated with investigation and remediation, though the scale of these impacts is not yet known.
What to do if you're exposed
Monitor bank and credit accounts for unusual activity. Enable multi-factor authentication on any accounts that may be linked to University Loft. Review privacy settings on services that store personal information. Individuals can also run a free exposure scan of their email address against known breach data to check for appearances in public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Stoughton Steel Listed by play Ransomware GroupJZ Russell Industries Listed by play Ransomware GroupRelease Marine Listed by play Ransomware GroupJabezco Industrial Group Listed by play Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the University Loft Listed by play Ransomware Group →
Publicly posted by play — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.