IT staffing firm The Computer Merchant this week confirmed it notified 34,127 people of a July 2024 data breach that compromised their names and Social Security numbers.
Ransomware gang Play took credit for the breach shortly after it occurred. The group says it stole private and personal confidential data including client documents, budget, payroll, accounting, and contracts.
The Computer Merchant has not verified Play’s claim. We do not know if The Computer Merchant paid a ransom, how much Play demanded, how attackers breached the company’s network, or why it took more than a year to notify some victims. Comparitech contacted The Computer Merchant for comment and will update this article if it replies.
“In July 2024, we experienced a cyberattack against our computer network,” says The Computer Merchant’s notice to victims. “At the time, our investigation did not uncover that personal information had been acquired by an unauthorized third party. In January 2025, we became aware of a claim that data from the incident had been made publicly available.”
The Computer Merchant is offering eligible victims free credit monitoring and a $1 million insurance policy. The enrollment deadline is November 19, 2025.
Who is Play?
Play is a ransomware group that targets organizations in healthcare finance, manufacturing, real estate, education, and more since June 2022. Its double-extortion model forces targets to pay a ransom both for a decryption key to restore infected systems and to not sell or publicly release stolen data.
Play has claimed 163 confirmed ransomware attacks in total, compromising more than 1.4 million records.
This week, several other companies also began issuing data breach notices in response to attacks claimed by Play. They include:
- Ojo Spa Resorts notified 2,163 people of a June 2025 data breach
- The Seydel Companies notifies 340 people of an April 2025 data breach
- Farmers’ Rice Cooperative notified 4,210 people of an August 2024 data breach
- Hullberg & Associates notified an undisclosed number of people about a July 2025 cyber attack
In 2025 to date, Play has claimed 20 confirmed attacks and made 238 unconfirmed claims that haven’t been publicly acknowledged by the targeted organizations.
Ransomware attacks on US business
In 2024, Comparitech researchers logged 854 confirmed ransomware attacks on organizations in the USA, compromising more than 276.5 million records. In 2025 so far, we’ve recorded 267 attacks affecting nearly 10 million records.
The Computer Merchant isn’t the only staffing firm to be hit by a ransomware attack:
- Manpower earlier this month notified more than 144,000 people following a December 2024 breach claimed by RansomHub
- Leaders Staffing in October 2042 notified 51,929 people of a January 2024 data breach claimed by Play
- TRC Talent Solutions in May 2024 notified 158,593 people of a data breach claimed by BlackSuit
- Find Great People in October 2024 notified 12,205 people of a July 2024 data breach claimed by Akira
- Ransomware gang Medusa in May 2024 demanded $2 million in ransom from Boyden
Ransomware attacks can lock down computer systems and steal data. Infected organizations must decide whether to pay a ransom or face extended downtime, permanent data loss, and putting data subjects at increased risk of fraud.
About The Computer Merchant
The Computer Merchant is an IT staffing firm based in Norwell, Massachusetts. According to its website, it has placed 63,000 professionals in jobs, served 2,500 employers, gets 50,000 new candidates per month, and has amassed 11 million candidate profiles in total.
