In September 2023, Bordelon Marine, a U.S.-based marine services company, fell victim to a targeted Play Ransomware Group attack. The cybercriminals, known for their advanced tactics, exploited system vulnerabilities and deployed tools like AdFind to extract Active Directory data before encrypting critical files with a '.play' extension. The attack was part of a wider campaign, with the group publicly listing Bordelon Marine among six organizations on their Tor-based data leakage site, strongly suggesting a data breach alongside the ransomware encryption. The incident aligns with the group’s pattern of double extortion—encrypting files while threatening to leak stolen data unless a ransom is paid. While the exact scope of compromised data (e.g., employee records, customer details, or proprietary marine operations) remains undisclosed, the public disclosure on the dark web implies sensitive information was exfiltrated. The attack disrupted Bordelon Marine’s operations, potentially halting services, damaging reputation, and incurring financial losses from recovery efforts or ransom negotiations. The Play Ransomware Group’s expansion into the U.S. underscores the escalating threat of sophisticated ransomware operations targeting critical infrastructure sectors.