Faulkner+Locke listed on Play ransomware leak site

• Ransomware group: Play
• Country: United States
• Sector: Professional Services
• Announcement date: February 22, 2026

Play ransomware group claims breach of Faulkner+Locke

The Play ransomware group has officially listed the United States-based organization Faulkner+Locke on its dedicated leak site. In a public announcement made on February 22, 2026, the threat actor group claimed to have successfully compromised the systems of the professional services firm. This latest incident follows an alleged initial access date of February 19, 2026, marking a rapid progression from the initial intrusion to the public listing of the victim.

The group's announcement indicates that they have gained unauthorized access to the organization's internal systems and have subsequently exfiltrated various types of sensitive data. A notable feature of the leak site's presentation is the presence of a countdown timer, which suggests that the group intends to publish the stolen information publicly if their demands are not met. This tactic is a hallmark of modern ransomware operations, where the threat of data exposure is used as a primary lever for extortion.

Alleged data exfiltration and contents

While the specific volume of the stolen data and the exact file counts have not been disclosed by the group, the nature of the information claimed to be stolen is highly sensitive. The Play group has asserted that the compromised datasets may include a wide array of confidential materials that could impact both the organization and its stakeholders. According to the announcement, the potentially exposed information includes:

• Client documents
• Budget records
• Payroll data
• Identification documents
• Tax records
• Financial information

The inclusion of such diverse data types suggests a comprehensive breach of the organization's digital environment, targeting both corporate financial records and the personal identifiable information of individuals associated with the firm.

Implications and potential risks

This alleged breach by the Play group poses significant secondary risks to the organization, its employees, and its clients. The potential exposure of identification documents, tax records, and payroll data creates a high risk for identity theft and financial fraud. When personal information is leaked, individuals often face long-term consequences as their data is circulated within criminal ecosystems.

Furthermore, because Faulkner+Locke operates within the United States, this incident may trigger complex legal proceedings. Depending on the specific nature and sensitivity of the exposed data, the organization may face scrutiny under various state-level data protection laws as well as federal regulations. The legal landscape for data breaches in the US is multifaceted, involving multiple layers of compliance and notification requirements.

The group's use of double extortion tactics—where data is both encrypted and stolen—is designed to maximize pressure on the victim. By threatening to release the data publicly, the attackers aim to cause significant reputational damage. Such a leak could also facilitate targeted phishing attacks against the organization's supply chain partners, as attackers may use the stolen client documents and financial information to craft highly convincing social engineering campaigns.

General defensive considerations

In response to such sophisticated threats, organizations in the professional services sector typically focus on strengthening their defensive posture. This includes implementing robust multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees to mitigate phishing risks. Additionally, maintaining offline, immutable backups and implementing strict network segmentation can help limit the lateral movement of attackers and ensure data integrity during an incident.