Landmark Rehab Group listed on Play ransomware leak site

• Ransomware group: Play
• Country: United States
• Sector: Healthcare
• Announcement date: February 26, 2026

Play ransomware group claims data breach at Landmark Rehab Group

The ransomware group known as Play has listed Landmark Rehab Group on its leak site, alleging that it has compromised the organization's data. This announcement, posted on February 26, 2026, references a security incident that the group claims occurred on February 17, 2026. Following the listing, the group has initiated a countdown for the publication of the alleged stolen information.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. In many cases, these groups employ a tactic known as double extortion. In a double extortion scheme, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of leaking this stolen information publicly serves as additional leverage to coerce the victim into paying a ransom. If the ransom is not met, the group threatens to release the data on these public-facing sites.

Details of the alleged data theft

The leak announcement provided by the Play group specifies that the compromised information includes a variety of private and personal confidential documents. According to the group's claims, the stolen data encompasses several critical categories of information that could impact both the organization and its stakeholders. The specific types of data mentioned in the listing include:

• Client documents
• Payroll records
• IDs
• Tax documents
• Financial information

While the group has claimed to possess these files, the specific volume of the data and the total number of files involved have not been disclosed in the announcement. Furthermore, no specific ransom demand has been made public at this time.

About Landmark Rehab Group

Landmark Rehab Group is a healthcare and rehabilitation services provider operating in the United States. The organization focuses on addiction treatment and rehabilitation processes, providing essential services to individuals within the healthcare sector.

Potential risks and industry implications

This alleged data breach may pose a significant risk of exposing sensitive information held by the organization. Given that the institution operates in the healthcare sector, this incident could lead to legal and administrative consequences under regulations such as HIPAA. Healthcare organizations are frequent targets for cybercriminals because the sensitive nature of medical and personal data can be used for high-value extortion.

Considering the Play group's known double-extortion tactics, the publication of this data may create secondary risks for employees and clients, including identity theft or targeted phishing attacks. When personal identifiers, financial records, and tax documents are exposed, individuals become vulnerable to sophisticated social engineering campaigns where attackers impersonate trusted entities to steal further information.

The Play group is a structure that has been observed since 2022 and is known to operate relatively covertly. For organizations facing such threats, it is often necessary to re-evaluate data security processes and notify the affected parties to mitigate harm. Common defensive steps for organizations in the healthcare sector include implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication across all systems, and maintaining rigorous monitoring of network traffic to detect unauthorized data exfiltration. Additionally, regular security audits and employee training regarding phishing attempts are vital components of a modern cybersecurity posture.