Rockrose Development Hit by PLAY Ransomware Attack, Exposing Sensitive Data Rockrose Development L.L.C., a prominent real estate developer and property manager operating in New York City and Washington, D.C., suffered a major data breach on July 4, 2025, after unauthorized actors infiltrated its systems. The cybercriminal group PLAY claimed responsibility for the ransomware attack, later posting about the breach on the dark web on July 14, 2025, and threatening to release stolen data if demands were not met. The exposed information includes a broad range of sensitive data, such as names, Social Security numbers, taxpayer IDs, driver’s license and passport numbers, bank account details, health insurance records, medical information, and online account credentials. The breach affects employees, residents, and other individuals associated with Rockrose. Rockrose launched an investigation with third-party cybersecurity experts, secured its systems, and implemented additional safeguards. The company disclosed the incident via a Notice of Data Security Incident on its website and reported the breach to the California Attorney General’s office on December 12, 2025. To mitigate potential harm, Rockrose is offering 24 months of complimentary Experian IdentityWorks to affected individuals and has established a dedicated call center for inquiries. The severity of the breach underscores the risks posed by ransomware attacks targeting high-value personal and financial data.