All Choice Rentals Listed by Play Ransomware Group

On June 26, 2025, the play Ransomware Group listed All Choice Rentals on its leak site, claiming that internal files had been exfiltrated from the Canadian rental company during a ransomware attack. Anyone whose personal information was stored in those files — tenants, applicants, employees, or their family members — now faces the risk that sensitive records have been stolen and may be published or sold.

What Public Reporting Shows

Public reporting indicates the incident involves All Choice Rentals, a Canadian business. The play Ransomware Group added the company to its data-leak portal on June 26, 2025. Available reporting describes the stolen material as internal files, though the exact volume and full list of exposed data types have not been publicly detailed. No confirmed victim count has been released.

Why This Matters for You and Your Family

When a rental company loses control of its internal files, the information inside often includes full names, addresses, phone numbers, email accounts, dates of birth, driver’s licence numbers, employment details, and sometimes banking information for background checks or rent payments. If any of those records belong to you or someone in your household, the breach can lead to identity theft, loan fraud, or unwanted contact. Children’s information is sometimes included in family rental applications, putting younger family members at risk before they even have their own credit history.

The Doxxing and Identity-Chain Implications

Stolen rental records rarely stay isolated. A single address or email can be cross-referenced with gaming usernames, social-media handles, and school records to build a complete profile. Credential leaks of this kind frequently cascade into account takeovers on Steam, Roblox, Epic Games, and other platforms where children or teens use the same password or recovery email. Once attackers link an address to a gamer tag, they can harass, extort, or sell the combined data set on underground forums. This identity-chain effect turns one corporate breach into long-term personal exposure for every member of the household.

Play Ransomware Group Track Record

Public reporting attributes the group’s emergence to 2022. It has since targeted healthcare providers, educational institutions, and small-to-medium businesses across multiple countries. The typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by claimed exfiltration of sensitive files before encryption. The group then demands ransom and, if unpaid, publishes samples or the full dataset on its leak site to pressure victims. Play’s public statements and leak-site activity show a consistent pattern of using double-extortion tactics.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate any password you used for All Choice Rentals portals or related services, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that chain back to the same address or recovery details.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing accounts.

The incident shows that rental and housing data have become routine targets. Acting quickly on credential hygiene and identity mapping can limit how far the breach travels. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to understand exactly what is exposed and begin closing the gaps.