Sam Pack Auto Group Data Breach

Sam Pack Auto Group, a prominent automotive dealership network based in the Dallas-Fort Worth metroplex, Texas, has been identified as an alleged victim of the Play ransomware group. The listing appeared on the group’s dark web portal on August 17, 2026, as detected by SOCRadar’s Dark Web Monitoring service. Operating within the Retail & E-Commerce sector, particularly in the automotive segment, Sam Pack Auto Group’s extensive network of dealerships makes it a potentially attractive target for cybercriminals seeking significant financial gains. In the 60 days preceding this listing, the Play ransomware group claimed approximately 24 other victims. Their targeting has predominantly focused on the Financial Services, Manufacturing, and other unclassified sectors, with a significant concentration of victims located in the United States, the UK, and Italy. Recent entities similarly listed by Play include Woodhaven Association, Bridgeport Capital Services, GCATS Investments, and Signature Services. The targeting of Sam Pack Auto Group aligns with Play’s recent trend of targeting US-based businesses, particularly within the retail and automotive industries.

SOCRadar’s analysis identified a single stealer-log record associated with the domain sampack[.]com. This record, logged on June 15, 2026, pertains to a masked-username credential targeting mail.sampack[.]com. While this single record does not definitively confirm a compromise by Play ransomware, it represents a significant exposure within the organization’s corporate email infrastructure. The presence of corporate email credentials is of high concern, as it grants attackers visibility into internal communications, potential access to sensitive information shared via email, and a pathway for initiating business email compromise (BEC) attacks. This type of access is highly valued by initial access brokers and can be a critical step in the pre-ransomware kill chain. The Play ransomware group typically utilizes infostealer logs to facilitate their operations. Their common kill chain involves initial access brokers validating credentials against mail servers or VPNs, subsequently selling direct access or deploying their ransomware. The observed corporate email credential aligns with this pattern, potentially serving as a stepping stone for further intrusion. The exposure of corporate email access, even from a single credential, represents a consequential risk. While this specific stealer-log entry does not prove that Play ransomware has successfully infiltrated Sam Pack Auto Group’s systems, it highlights a critical vulnerability that could be exploited. Immediate actions advised include auditing access logs for mail.sampack[.]com from June 15, 2026, onwards and initiating a mandatory password reset for the associated account to mitigate the risk of further unauthorized access.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.