Riverwood Golf Club listed on Play ransomware leak site

• Ransomware group: play
• Country: United States
• Sector: Hospitality
• Announcement date: January 20, 2026

Riverwood Golf Club has been listed on the leak site of the ransomware group known as Play. The group claims to have obtained various confidential data belonging to the organization, marking a potential significant security incident for the hospitality provider.

The claimed attack and event details

The Play ransomware group added Riverwood Golf Club to their leak site on January 20, 2026. According to the group's announcement, the breach occurred following an incident on January 12, 2026. The group alleges that they successfully obtained the organization's data during this period.

A notable feature of the leak announcement is the presence of a countdown timer. This timer is set for the publication of the stolen data, a common tactic used by ransomware groups to increase pressure on their targets. Such countdowns are designed to create a sense of urgency and psychological stress, aiming to coerce the victim into meeting the group's demands before the information is released to the public.

Data types allegedly involved in the breach

While the specific volume of the stolen data and the exact ransom demand remain unknown, the group has provided details regarding the nature of the information they claim to have exfiltrated. Based on the screenshots provided by the attackers, the data allegedly leaked includes a wide variety of sensitive documentation.

The information claimed to be part of the leak includes:

• Client documents
• Budget records
• Payroll information
• IDs
• Tax records
• Financial information

The breadth of this data suggests a comprehensive compromise of the organization's internal administrative and financial systems.

About Riverwood Golf Club

Riverwood Golf Club is an 18-hole golf course and social facility located in Port Charlotte, Florida. It provides golf experiences along with various event and social amenities to its members and visitors.

Potential implications and industry risks

These allegations may pose secondary risks such as identity theft and fraud for the organization's employees and customers. As the organization is based in the US, confirmation of the breach could lead to implications under state-level data privacy laws and regulatory sanctions. Given that the Play group is known for double extortion tactics, the publication of the data could damage the organization's commercial reputation and facilitate targeted phishing attacks.

Double extortion is a common ransomware tactic where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak the data publicly, the attackers aim to maximize their leverage, knowing that the reputational damage and legal consequences of a data leak often outweigh the immediate operational impact of encryption.

Considering that the Play group has been active since 2022, it is possible that the organization may experience disruptions in its operational processes. For organizations in the hospitality sector, such disruptions can impact member services, event scheduling, and overall guest experience. To mitigate such risks, organizations typically focus on robust data protection strategies, including regular backups, encryption of sensitive information, and strict access controls to limit the potential scope of a breach.