On July 23, 2026, Restaurant Depot was listed on the leak site operated by the Play ransomware group. The listing states that the U.S. foodservice wholesaler suffered a ransomware attack in which internal files were exfiltrated. The company has not yet issued a public breach notification detailing the number of individuals affected or the precise data categories involved.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Not ready yet? Run a free breach check on this email
We’ll check it against 13.1B+ leaked records right now — no account needed. Continuous monitoring & alerts are part of Protection.
Reported Details from the Leak Site
The Play ransomware leak site explicitly names Restaurant Depot and claims successful data exfiltration following a ransomware deployment. The posting does not quantify the volume of data taken, list specific record counts, or enumerate the types of files beyond describing them as internal files. No ransom demand figure or payment deadline is shown in the current listing. The disclosure indicates the incident occurred prior to the July 23 publication date, but the exact breach timeline remains undisclosed by both the threat actor and the victim at this time.
Why This Matters for You and Your Family
When a company like Restaurant Depot is breached, the people most directly impacted are its customers, suppliers, employees, and their families. If you have shopped at Restaurant Depot, worked there, or had your personal information on file with them as a vendor or business customer, your data may now sit in a ransomware actor’s archive. Even though the leak site does not specify what was taken, ransomware operators routinely harvest employee records, customer databases, vendor contracts, tax forms, and scanned documents containing names, addresses, Social Security numbers, and financial details. Any of these can be used for identity theft, tax fraud, or spear-phishing attacks against you and your household.
The Doxxing and Identity-Chain Risk
Exfiltrated internal files frequently contain more than isolated records. They often include spreadsheets that link employee names to personal email addresses, phone numbers, dates of birth, and sometimes family member details. Once such data reaches a ransomware leak site or dark-web markets, it becomes raw material for doxxing chains. Threat actors or opportunistic criminals can combine it with information from other breaches to build complete identity profiles. Credential leaks tied to corporate systems also cascade into personal account takeovers, including email, banking, and gaming accounts belonging to you or your children. Public reporting on Play shows they frequently publish or sell stolen data when victims do not pay, increasing the likelihood that this material will circulate further.