Ransomware Group: PLAY

VICTIM NAME: Couri Insurance Agency

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the PLAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The leaked data concerns Couri Insurance Agency, a financial services provider based in the United States. The incident was publicly disclosed on March 2, 2025, indicating a significant data compromise that may affect the agency’s operations and its customers. Although no specific compromise date was listed, the discovery of the ransomware page suggests that sensitive information may have been at risk during this timeframe. The agency is associated with the financial sector, potentially impacting client trust and confidentiality. The leak page includes a link to the ransomware group known as “Play.”

The leak page contains a screenshot of a document related to the compromised agency, reflecting the nature of the data that may have been accessed. No personal or sensitive details are disclosed in this briefing; however, the presence of the ransomware threat presents serious implications for Couri Insurance Agency. Additionally, the website for Couri Insurance Agency is noted as www.couri.com, providing further context for the company’s operations. As the situation unfolds, stakeholders should remain vigilant regarding potential impacts of this security breach.