Landmark Rehab Group Listed by play Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 26, 2026, reports indicated that the Play ransomware group listed Landmark Rehab Group on its leak site in connection with a ransomware incident. The listing states that internal files were exfiltrated during the attack. The organization is based in the United States. No figure has been released for the number of individuals whose information may be involved, and further technical details about the intrusion remain undisclosed at this time. This development occurs against a backdrop of sustained ransomware activity directed at healthcare and rehabilitation providers, where threat actors continue to combine encryption with data theft to pressure victims.

Inside the incident

The available information is limited to the public listing by the Play group. It asserts that a ransomware operation against Landmark Rehab Group resulted in the removal of internal files. No confirmation of the volume of data, the precise date of the intrusion, or the methods used to gain initial access has been made public. The number of people potentially affected is also not stated.

Inside play

Play is a ransomware operation that has conducted multiple campaigns since at least 2022. Public reporting has documented its use of double-extortion tactics, in which data is both encrypted on victim systems and copied for potential release. The group maintains a leak site where it lists organizations it claims to have targeted. Its activity has spanned several industries, though specific claims regarding any single victim are presented by the group itself and require independent verification.

Landmark Rehab Group and its sector

Landmark Rehab Group operates in the rehabilitation and post-acute care sector. Organizations of this type routinely manage patient scheduling, treatment records, insurance details, and internal administrative systems. A successful intrusion at such a provider can expose both operational documents and records that contain personal and health-related information, increasing the potential consequences for individuals whose data is held by the organization.

What data was at risk

The listing refers only to “internal files” without further specification. The exact categories of data involved have not been confirmed. Rehabilitation providers commonly store patient identifiers, clinical notes, billing records, and employee information, but it is not possible to state which of these elements, if any, were taken in this case.

The real-world impact

Individuals whose records may be involved face the possibility that personal or medical details could be used for identity-related fraud or unauthorized access to services. For the organization, the incident adds to the operational and regulatory burdens that typically follow ransomware events, including notification requirements and potential scrutiny from oversight bodies. The absence of a confirmed count of affected people leaves the full scope of exposure unclear.

What to do if you're exposed

Anyone who has received services from Landmark Rehab Group or similar providers should monitor financial and insurance accounts for unusual activity and consider placing fraud alerts with credit bureaus. Changing passwords for any associated online portals and enabling multi-factor authentication where available are standard protective measures.

• Review statements from insurers and healthcare providers for unrecognized claims.
• Request a free credit report from each of the major bureaus to check for new accounts.
• Run a free exposure scan of your email address against known breach data to determine whether your information appears in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.