Saddlers Court MFG Data Breach

Play ransomware claimed Saddlers Court MFG, a manufacturing firm based in the UK, on October 13, 2026. This claim adds to Play’s activity targeting UK entities, with Saddlers Court MFG being the sole UK victim identified in a recent batch of five incidents that also included victims in the US and Germany. The manufacturing sector appears to be a consistent target for Play, and this incident highlights potential vulnerabilities within the industry, especially where legacy and modern IT systems converge. Analysis of Play’s recent activities shows a broad targeting pattern across the US, Germany, and the UK. The manufacturing and industrial sectors are frequently represented on Play’s leak site, indicating a strategic focus on these industries. While this specific claim marks the third manufacturing victim in the analyzed reporting cycle, it does not necessarily signify a coordinated campaign exclusively against UK manufacturers, as Play operates globally. However, the consistent targeting of this sector warrants attention from organizations within it.

Prior to the public claim by Play ransomware, SOCRadar queried criminal market sources for the domain saddlerscourtmfg[.]com. The investigation returned no associated credential records. This absence of readily available data suggests that the initial access vector utilized by the threat actor is not immediately apparent through standard stealer-log monitoring. Potential methods include targeted phishing campaigns aimed at operational or procurement staff, exploitation of manufacturing-specific enterprise resource planning (ERP) systems, or the compromise of credentials obtained from sources not covered by SOCRadar’s current collection scope. The lack of exposed credentials on saddlerscourtmfg[.]com does not rule out a compromise or preclude the possibility of future malicious activity. It indicates that the attack might have originated through other means, such as exploiting unpatched vulnerabilities in network-facing applications, direct access broker (IAB) involvement, or the use of credentials not directly tied to the primary corporate domain. Organizations in the manufacturing sector should remain vigilant, particularly concerning the integration of operational technology (OT) with IT infrastructure, as this often presents a larger attack surface. Given the targeting patterns of Play ransomware, which often focuses on organizations with a blend of legacy and modern IT systems, manufacturers are advised to review their security posture. This includes ensuring all systems, including ERP and production scheduling software, are up-to-date with security patches and that network segmentation is robust. For UK manufacturers, following guidance from the National Cyber Security Centre (NCSC) is crucial, with a particular emphasis on implementing and testing offline backup strategies for critical operational systems, which are vital for effective ransomware recovery.