Play Ransomware Gang Claims Attack on MyPillow, Threatens Data Leak The Play ransomware group has listed MyPillow, the U.S.-based bedding company founded by election conspiracy theorist Mike Lindell, as an alleged victim. The extortionists added the company to their dark-web leak site on Monday, warning that stolen data including confidential financial records, payroll, client documents, and personal IDs would be released by Friday unless a ransom is paid. Play did not disclose the volume of exfiltrated data but claimed it encompasses sensitive internal and customer information. MyPillow has not responded to requests for comment. As of May 2025, the FBI reports that Play has targeted approximately 900 organizations, with its ransomware variant ranking among the top threats to critical infrastructure. The group has a history of high-profile attacks, including the 2023 breach of Swiss government files via IT supplier Xplain and a 2024 intrusion at semiconductor firm Microchip Technology, which incurred $21.4 million in recovery costs. Security researchers note that Play has employed "EDR killers" to disable endpoint protection during attacks. The group has also been linked to North Korean state-backed hackers. MyPillow, led by Lindell a prominent supporter of former President Trump’s 2020 election fraud claims and a current Minnesota gubernatorial candidate has faced scrutiny over its founder’s political activities. The ransomware incident adds to the company’s recent challenges.

Microchip Technologies, a semiconductor supplier, has been a notable recent victim of the Play ransomware group. The attack involved the exfiltration of sensitive data followed by system encryption, with threats to publish stolen information if ransom demands were not met. This double extortion model has caused significant disruption and potential financial loss for the company.

In 2023, Microchip Technology, an American semiconductor manufacturer, was targeted by the Play ransomware group. The attack involved encrypted devices and the theft of significant amounts of data. The Play group initially accessed the company’s systems through vulnerabilities in remote monitoring tools like SimpleHelp. The ransomware operators recompiled the malware for each attack, making it difficult for defenders to detect and stop the ransomware. The attack had a profound impact on the company's operations and data security.