Play Ransomware Targets US Telecom Sector with Back-to-Back Breaches Play ransomware has added Hightower Communications, a US telecommunications provider, to its dark web leak site, marking the second attack on the sector in just ten days. The group previously listed Legend Networking and Telecom on May 25, signaling a deliberate focus on US telecom infrastructure rather than opportunistic attacks. The breach exposes highly sensitive data, including subscriber identity records, call detail records (CDRs), SMS metadata, billing records, and network routing configurations. CDRs detailing call timestamps, durations, and locations can reveal personal and professional networks, movement patterns, and behavioral routines. Additionally, E911 emergency services data and law enforcement intercept infrastructure governed by CALEA may be at risk, depending on Hightower’s network architecture. As a telecommunications carrier, Hightower is subject to FCC breach notification rules and Customer Proprietary Network Information (CPNI) regulations, which impose stricter disclosure requirements than standard state data breach laws. The appearance on Play’s leak site triggers regulatory timelines, regardless of whether the full scope of the compromise is confirmed. Play’s historical timeline suggests the initial breach likely occurred in late April or early May, with attackers maintaining access for weeks before public disclosure. The rapid succession of telecom targets Legend Networking on May 25 and Hightower in early June indicates either active sector targeting or simultaneous campaigns against multiple providers, heightening risks for the broader US telecom industry. Hightower has not publicly confirmed the breach, and the exact data in Play’s possession remains unverified. However, the group’s track record of following through on leak site threats places the company under immediate legal, operational, and reputational pressure. Subscribers, particularly those with exposed CDRs or CPNI-protected data, face potential downstream risks while awaiting official disclosure.