Select Tool Listed by Play Ransomware Group

On March 1, 2026, the ransomware group known as Play added Select Tool, a Canadian company, to its public leak site, claiming that internal files had been exfiltrated during a ransomware attack.

What Public Reporting Shows

Public reporting indicates the incident involves internal files taken from Select Tool’s systems. The company is based in Canada, though the exact number of people whose information may be contained in the files remains unknown. Available reporting describes the data as exfiltrated during a ransomware deployment, with the group posting details on its leak site hosted on the dark web. No specific types of personal records such as names, addresses, or financial details have been publicly detailed in the initial listing.

Why This Matters for You and Your Family

When a company’s internal files are stolen, the information inside can easily include customer records, employee details, vendor contacts, or partner data that points back to ordinary people like you. Even one exposed email or phone number creates a starting point for identity thieves. Your family’s privacy is at risk because these files often contain linked records — a parent’s work email next to a child’s school information, or a home address tied to multiple family members. Once that data leaves the company’s control, it can circulate for years on underground forums.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently contain more than isolated records. They can include spreadsheets that connect names, emails, phone numbers, addresses, and sometimes account details across systems. Attackers use these connections to build identity chains — linking your work identity to personal accounts, social media handles, and even your children’s online profiles. Credential leaks like this one regularly cascade into account takeovers, especially for gaming accounts where kids often reuse passwords or email addresses tied to family domains. The result can be doxxing, harassment, or financial fraud that starts from a single company breach and spreads outward.

Play Ransomware Group’s Track Record

Public reporting attributes the Play ransomware group’s emergence to 2022. The group has targeted organizations across multiple countries, with notable prior victims including healthcare providers, manufacturers, and technology firms. Their typical playbook involves initial access through compromised credentials or vulnerabilities, followed by claimed exfiltration of sensitive files before deploying ransomware. They then extort victims by threatening to publish the stolen data on their leak site if payment is not made. Reporting notes that Play often sets short deadlines once data is listed, though exact timelines for this Select Tool incident have not been independently verified.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains exist from this claimed breach.
• Rotate any password you used at Select Tool or any related service, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and your children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests for any exposed data found on broker sites or forums.

The Select Tool breach is a reminder that ransomware groups continue to target organizations that hold ordinary families’ information. Taking concrete steps now can limit how far this incident reaches into your life. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion-plus breach records and over 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to understand and close the gaps this claimed breach may have opened.