On February 17, 2026, the Play ransomware group added Landmark Rehab Group to its public leak site, claiming that internal files had been exfiltrated from the U.S. healthcare provider during a ransomware attack. Anyone whose medical records, insurance details, or personal information passed through Landmark Rehab now faces the possibility that their data sits on a dark-web leak page accessible to criminals.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Landmark Rehab Group
Get alerted the next time Landmark Rehab Group files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Landmark Rehab Group’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Available reporting describes the incident as a classic ransomware operation in which the attackers gained access, encrypted systems, and then exfiltrated files before demanding payment. The Play group published proof of the breach on its leak site, a standard tactic used to pressure victims. Exact victim counts remain undisclosed, and the specific types of internal files have not been itemized in public summaries. The listing appeared on February 17, 2026, giving the organization a short window to negotiate before broader data publication.
Why This Matters for You and Your Family
When a healthcare provider loses control of internal files, the exposed information often includes names, addresses, dates of birth, Social Security numbers, medical histories, and insurance records. Criminals can combine these details with data from other breaches to commit identity theft, file fraudulent tax returns, open accounts in your name, or demand payment to keep your medical conditions private. For families, one parent’s rehab visit can expose an entire household’s contact information, making every member a potential target for phishing, scams, or harassment. The breach is not abstract; it is your family’s private health data now sitting in criminal hands.
The Doxxing and Identity-Chain Implications
Healthcare records frequently contain email addresses, phone numbers, and physical addresses that link directly to your online identities. Once criminals possess these, they can map your gaming usernames, social-media handles, and family members’ accounts into a single profile. Credential leaks like this one routinely cascade into account takeovers on gaming platforms, where children’s usernames become entry points for further harassment or extortion. Public reporting indicates that chains built from healthcare data often lead to doxxing campaigns that reveal home addresses, family relationships, and daily routines. The longer the data circulates unchecked, the harder it becomes to contain the damage.