Greg Crosslin Data Breach

Greg Crosslin, an organization based in the United States, has been listed as a victim on the Play ransomware group’s dark web portal, published on June 17, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. Although the specific sector for the entity is not recorded, the addition places it among Play’s steady stream of recent North American victims. In the 60 days preceding this listing, Play has claimed 17 other victims. The group primarily targets the transportation and logistics, construction, and business services sectors, with a strong concentration of victims in the United States.

Initial access correlation against SOCRadar’s stealer-log telemetry showed no records for Greg Crosslin. However, a null result does not confirm the absence of credential exposure. Credentials may have been used under alternate corporate domains, personal email aliases, or exist in feeds not covered by the query. For ransomware groups like Play, infostealer-harvested credentials are a common initial access vector. CTI teams should continue monitoring and implement proactive credential-hygiene measures, rather than interpreting a null query as exoneration.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.