Minor League Baseball · Breach

PLAY claims ransomware attack on Minor League Baseball

Nov 11, 2026 · 1 min read

The PLAY group listed Minor League Baseball on its leak site and claimed access to internal data. MiLB has not confirmed the incident, and the claim has not been independently verified.

By HIFY Radar newsroom Updated 11/11/2026 06:24 PM Get this every day →← Back to the feed 2 sources

LowBreachNo software to update

In 30 seconds

Alleged

The latest report in the evidence set says the PLAY ransomware group listed Minor League Baseball on its leak site. The listing reportedly provided no files or other proof, MiLB has not publicly confirmed an incident, and the claim remains independently unverified.

What happened

Contested

DarkWebInformer reported that PLAY scheduled publication for November 15, 2026 and claimed access to private documents, payroll, identification, tax and financial records. DailyDarkWeb, posting moments later, said the listing showed no file count, volume, sample or description of the records. The supplied evidence does not resolve this difference.

Why it matters

Inferred

If the claim proves genuine, the possible exposure could extend beyond league administration because MiLB works with clubs and handles staff, partner, ticketing and fan information. That is a risk scenario, not evidence that any particular person, club or dataset was affected.

What to do

Inferred

Treat the listing as an alert rather than a confirmed breach. Staff, clubs and partners should rely on direct MiLB notices, remain cautious about unexpected account or payment requests, and avoid assuming the claimed data categories were actually obtained.

Confirmed and still uncertain

Observed

What is known from the supplied material is limited to two monitoring accounts reporting a PLAY leak-site entry. It remains unknown whether MiLB systems were compromised, whether files were copied or encrypted, how access might have occurred, and whether the threatened publication will happen.

What people are saying

Observed

DailyDarkWeb explicitly cautioned that the entry was a threat-actor claim, not confirmation of a breach. DarkWebInformer likewise labeled the claim unverified while relaying the alleged publication date and data categories.

Evolution

Observed

DarkWebInformer first reported an alleged November 15 publication deadline and described categories of supposedly accessed records. Moments later, DailyDarkWeb added a more cautious assessment: no sample, file count or data volume was visible, and neither MiLB confirmation nor independent verification was available.

Reach

Observed

2 independent groups, 1 updates, and 9 engagements.

Technical detail

Contested

No downloadable sample, file count or total volume is established in the evidence. One report says the size was undisclosed and lists alleged record categories, while the other says the listing did not identify what was taken. Neither supplies forensic indicators, an intrusion method or evidence of encryption.

Sources and evidence

Observed

The evidence consists of two near-simultaneous X posts from DailyDarkWeb and DarkWebInformer, each accompanied by an image. The supplied set contains no direct statement from MiLB, no independently authenticated stolen material and no primary forensic report, so it supports reporting the claim but not confirming an attack.