On January 14, 2026, roofing contractor Encore Roofing was listed on the leak site of the Play ransomware group, with attackers claiming to have exfiltrated internal files from the U.S.-based company.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Encore Roofing
Get alerted the next time Encore Roofing files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Encore Roofing’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates the listing appeared on the Play ransomware group’s leak site, hosted on the dark web. The entry states that internal company files were taken during a ransomware incident. No specific count of affected individuals has been disclosed, and the precise volume or sensitivity of the stolen data remains unclear from available information. The incident follows the group’s typical pattern of encrypting victim systems and then publishing samples of exfiltrated material when ransom demands are not met.
Why This Matters for You and Your Family
When a company that holds your personal information suffers a breach, the fallout can reach your household directly. Internal files often contain customer records, contracts, payment details, insurance information, or employee data. If your name, address, phone number, email, or financial details were stored in Encore Roofing’s systems, those records may now sit on a ransomware leak site accessible to criminals. For families, this means increased risk of identity theft, loan fraud in your name, or targeted scams that use real details about your home or recent roofing project to sound legitimate.
The Doxxing and Identity-Chain Risk
Stolen internal files frequently include spreadsheets that link names to addresses, phone numbers, email accounts, and sometimes dates of birth. Criminals combine this information with data from previous breaches to build detailed profiles. A single exposed email can lead to account takeovers on shopping sites, social media, or even your children’s gaming accounts. Once attackers control one account, they harvest more contacts, photos, and location history, creating long identity chains that fuel doxxing, swatting, or extortion attempts against you or family members.