Play listed a Calgary golf club. That is a claim. The member file is still the file.

Play put Inglewood Golf on a leak site on September 18. The domain in the listing is inglewoodgolfclub.ca, a Calgary club. Aggregators repeated the post over the weekend. The group's line, as DeXpose quoted it, is the usual one: a leak unless someone uses their channel. As of this morning the club has not published a confirmation. Treat the listing as a claim, not a census. Also treat a Calgary membership book as the kind of file a leak site likes: names, emails, card-on-file hints, staff mail.

What is actually known

Ransomware.live logged the listing at 20:43 UTC on September 18. Breach House still had the club as not disclosed. GalaxyWarden said the same: Play claims stolen internal data, the club has not said so in public. We have not seen a provincial notice, a member letter, or a statement on the club site. That gap is the story. A leak-site row is how pressure starts. It is not a substitute for the club saying what, if anything, left the building.

Public DNS for the domain points mail at Microsoft 365 and includes Clubhouse Online in the SPF record (clubhouseonline-e3.com). That is membership and tee-sheet software a lot of Canadian clubs sit on. It is not proof of an entry path. It is a reminder that a club's "website" is often a vendor stack: bookings, dining, billing, a shared inbox. Play has a long history of mid-size operators, not only hospitals and cities. A golf club is a hospitality shop with a member list. That is enough motive without inventing a zero-day.

Why this is an Alberta problem even if you do not golf

Calgary is a short drive and a shorter rumour. Members will get "your account was in the Inglewood leak, reset here" mail whether or not their row exists. Staff will get the same. If you run another club, a yard, or a shop that keeps a member or customer file on a vendor portal, this is the same shape as IDScan last week: the processor you never named is part of the incident. Ask the membership vendor where backups live, who can export a batch, and what they will send you when a listing appears.

Nipigon hospital last week was a confirmed operational outage. This one is a listing. Do not mash them together. Do not pay a site that offers to "check if you are in the Play dump." That is a second harvester.

What we would do this week

• If you are a member or a vendor to the club, watch for phishing that uses the listing as a pretext. Change the password you actually reused. Freeze nothing on a rumour, but do not ignore a real charge you did not make.
• If you run a club or a similar membership shop, write down the membership vendor, the backup location, and the last restore test. Play does not care that you are not a hospital.
• If the club later confirms a theft, the first honest sentence is what left and who was told. Until then, a leak-site screenshot is not a notification letter.
• Backups that the same admin account can wipe are the finding we keep repeating this month. Acronis on a hosting panel was on the federal clock yesterday. A club NAS is the same question in smaller type.

Bottom line

A leak-site listing is a claim. A membership file is still a membership file. Forensic Five reviews what is copied and who can reach it, including the tee-sheet vendor a board never put on the risk register. From St. Albert, Alberta. Wait for the club's sentence. Do not wait to ask your own vendor the ugly questions.