Rockwood Retirement Communities Hit by Kairos Ransomware Attack
Sensitive personal data of residents exposed in a breach discovered in late February 2026.
Rockwood Retirement Communities in Spokane, Washington, has fallen victim to a ransomware attack that exposed the sensitive personal information of its residents. The breach, which was discovered around February 27, 2026, has triggered a legal investigation into potential class-action litigation.
The attack was carried out by the threat group known as 'kairos.' According to confirmed reports, the breach resulted in the exposure of highly sensitive data, including names, social security numbers, home addresses, phone numbers, and dates of birth. The law firm Ahdoot & Wolfson is currently investigating the incident to determine the full scope of the impact and is seeking potential plaintiffs for a class-action lawsuit.
The Nature of the Attack
Ransomware attacks on healthcare and senior living facilities have become increasingly common as threat actors target organizations that manage critical, time-sensitive data. In this instance, the 'kairos' group utilized encryption and data exfiltration tactics to compromise the facility's systems. By stealing personally identifiable information (PII), attackers often leverage the threat of leaking data publicly to coerce organizations into paying ransoms.
Why This Matters
The exposure of social security numbers and birthdays is particularly perilous for the elderly population served by Rockwood. Seniors are frequently targeted for identity theft and financial fraud due to their often-stable credit histories and potential lack of familiarity with modern digital security monitoring. When this data is leaked, it provides criminals with the exact toolkit needed to open fraudulent accounts or commit medical identity theft, which can disrupt essential healthcare services.
What's Next
As the investigation by Ahdoot & Wolfson continues, the focus will shift toward whether Rockwood Retirement Communities maintained adequate cybersecurity protocols to protect resident data. It remains to be seen if the organization has provided formal notification to all affected individuals or if the 'kairos' group has released the stolen data on the dark web. Residents are encouraged to monitor their credit reports and freeze their credit to prevent unauthorized accounts from being opened in their names.