VULNpocalypse
LowBreach / campaignMonitoring

Play ransomware group claims AVIR on its leak site, per RansomLook

RansomLook reports the Play ransomware group listed AVIR on its leak site; the claim is unverified, so AVIR partners should watch for official notices.

Published
Exploitation
Not confirmed, the only evidence is a leak-site listing reported by RansomLook

What happened

According to RansomLook, AVIR has been claimed by the Play ransomware group on that group’s leak site. RansomLook published the entry on 2026-11-04.

This advisory is based on that headline alone. The full article could not be reviewed. A leak-site listing is a claim made by the group, not proof of an attack.

Not confirmed:

  • AVIR has not confirmed any incident, according to the available source.
  • No independent verification of the claim is available.
  • Whether any data was taken or encrypted is not confirmed.
  • How any intrusion happened is not confirmed.
  • Which AVIR entity is meant is not confirmed.

Am I affected?

Not confirmed. The source does not say which systems, data or people might be involved. If you are a customer, supplier or employee of AVIR, any exposure depends on details that have not been published.

What to do now

  1. Watch for an official statement or breach notification from AVIR.
  2. Treat unexpected messages that claim to come from AVIR or mention this incident with caution, and verify them through known contact channels.
  3. Check back for updates as more reporting becomes available.

Sources