Condere Ip, Infracom Group Listed by play Ransomware Group

On September 24, 2024, the ransomware group known as Play added Condere Ip and its parent Infracom Group to its public leak site, claiming that internal files had been exfiltrated from the Swedish companies during a ransomware attack. Anyone whose personal or business data was stored with these infrastructure and communications providers now faces the concrete risk that sensitive records have moved into the hands of extortionists.

Reported Details from the Listing

The Play ransomware leak site states that both Condere Ip and Infracom Group were compromised in a ransomware operation. It explicitly lists internal files exfiltrated but does not disclose the volume of data, the exact systems accessed, or the number of individuals whose information was taken. The disclosure indicates that the companies were given a deadline to negotiate before samples or full datasets would be published. As of the listing date, no specific categories of exposed records—such as customer contracts, employee payroll files, or technical credentials—have been detailed on the site.

Why This Matters for You and Your Family

When infrastructure and IT-services providers like Infracom Group are hit, the impact reaches far beyond the corporate perimeter. If you or your family use any Swedish organisation that relies on Condere Ip or Infracom for hosting, cloud services, telephony, or managed networks, your personal data may have been sitting inside the very systems now compromised. Internal files frequently contain contracts, invoices, support tickets, and contact lists that include home addresses, phone numbers, email accounts, and sometimes national identification numbers. Once those records leave the victim’s control, they become raw material for identity theft, targeted phishing, and long-term fraud against ordinary households.

The Doxxing and Identity-Chain Risk

Exfiltrated internal files rarely contain isolated facts. A single leaked spreadsheet can link your work email to a personal mobile number, then to a child’s gaming username stored in a support ticket. These connections allow attackers—or anyone who buys the data—to build a complete identity chain that jumps from corporate breach to personal accounts. Credential leaks of this type routinely cascade into gaming-platform takeovers, especially for children whose usernames and reused passwords appear in the same datasets. The longer the chain remains unmapped, the higher the chance that one breach becomes dozens of account compromises and eventual doxxing.

Play Ransomware Group Track Record

Public reporting attributes the Play gang with emerging in mid-2022 and rapidly establishing a double-extortion model that combines data theft with encryption. The group has targeted organisations across Europe and North America, including healthcare providers, manufacturers, and technology service firms. Their typical playbook begins with initial access gained through compromised remote desktop credentials or phishing, followed by extensive internal reconnaissance, data exfiltration, and then simultaneous deployment of ransomware and publication threats on their leak site. Play has repeatedly demonstrated willingness to release sensitive samples when victims refuse payment, making the September 24 listing a credible signal that negotiations with Condere Ip and Infracom either failed or never began.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the Infracom compromise.
• Rotate any password you used at Condere Ip, Infracom, or their client organisations, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces within hours instead of months.
• Cover the entire household with DoxxScan family protection, which includes dependents and children’s gaming accounts that often reuse credentials exposed in corporate leaks like this one.
• Let DoxxScan remediation specialists manage takedown requests for any personal records that surface on data-broker or extortion sites.

The Condere Ip and Infracom Group breach is a reminder that infrastructure providers hold far more personal data than most families realise. Acting quickly on the exposure can limit how far attackers push the stolen files. Start your DoxxScan trial today and combine continuous monitoring, identity-chain mapping, and hands-on specialist remediation to protect yourself and your family from both this incident and the ones that will inevitably follow.