Round Hill Country Club listed on Play ransomware leak site

• Ransomware group: Play
• Country: United States
• Sector: Hospitality
• Announcement date: May 25, 2026

Play ransomware group claims data breach at Round Hill Country Club

The Play ransomware group has officially listed Round Hill Country Club on its dedicated leak site. According to the announcement, the threat actor group claims to have successfully compromised the organization's data, marking a significant security incident for the hospitality entity.

The listing appeared on the group's leak site on May 25, 2026. The group alleges that the breach occurred around May 19, 2026. Through this announcement, the attackers claim to be in possession of various sensitive files belonging to the organization, including both financial and personal information. The Play group is a known threat actor in the cybercrime landscape, having been active since 2022. They are widely recognized for employing double-extortion tactics, a method where attackers not only encrypt an organization's systems but also steal sensitive data to threaten its public release if a ransom is not paid.

Details of the alleged data theft

While the specific volume of the stolen data and the exact ransom demand remain unknown, the group has specified the types of information they claim to have exfiltrated. The leaked content is said to include highly sensitive and confidential materials that could impact both the organization and its stakeholders.

The information allegedly stolen includes:

• Client documents
• Budget data
• Payroll information
• Identity documents
• Tax records

The exposure of such diverse datasets, ranging from internal financial records like budgets and payroll to personal identifiers and tax documentation, highlights the potential breadth of the compromise.

About Round Hill Country Club

Round Hill Country Club is a private golf and social club situated in Alamo, California. The facility serves its members by providing access to a variety of amenities, including a golf course, tennis courts, and swimming pools. Additionally, the club offers various social event spaces for its membership base.

Potential impact and security implications

The alleged breach carries significant risks for the organization and its constituents. For the clients and employees of the club, the exposure of identity documents and personal information increases the risk of identity theft and fraudulent activities. Because the organization is based in the United States, this incident may trigger specific legal requirements, such as state-level data breach notification laws, and could lead to potential legal scrutiny.

The use of double-extortion tactics by the Play group places additional pressure on the organization. This tactic is designed to maximize leverage by using the threat of data exposure to compel payment, and it can lead to secondary attacks or highly targeted phishing campaigns aimed at the organization's contacts. Furthermore, the exposure of financial data, such as budget and payroll information, could result in long-term reputational damage and cause significant operational disruptions for the institution.

In such scenarios, organizations often face the challenge of managing both technical recovery and the legal and reputational fallout of a data leak. The exposure of sensitive documentation necessitates a careful approach to communication and compliance with regional data protection regulations to mitigate the impact on all affected parties.