Ransomware Group intelligence

Rhysida

Active

Track Rhysida with 305 published victims and 7 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 305 Known published victims in this dataset

First discovered 2023-06-05 Earliest victim discovery date

Last discovered 2026-10-11 Latest victim discovery date

Inactive since 2 days Days since the latest known victim

Top country United States 136 victims

Known locations 7 Leak or negotiation infrastructure tracked

Rhysida is tracked by Breach House as a ransomware group with 305 published victims.

United States is currently the most targeted country in this dataset.

7 known leak locations are currently associated with this group.

305

Leaked 25 8.2%
Pending 279 91.5%
Deleted 1 0.3%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 4	Onion service	Up checked 1h ago	`rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion`
Leak location 7	Onion service	Up checked 1h ago	`rhysidaqho36b6i6mvpmy5di4ro5zglovtxixrirky6q3fgack7q5uyd.onion`
Leak location 1	Onion service	Up checked 1h ago	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
Leak location 2	Onion service	Up checked 1h ago	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
Leak location 3	Onion service	Up checked 1h ago	`rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion`
Leak location 6	Onion service	Down checked 1h ago	`rhysidaeoxtkejwuheks3a7htk4zn3dfuynt5mqw6oawlcx6kcxjdeyd.onion`
Leak location 5	Onion service	Down checked 1h ago	`grhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion`

Not identified 47
Education 44
Communication / Marketing 41
Healthcare / Pharma 34
Public Sector 27
Manufacturing / Engineering 20
Finance / Legal / Insurance 17
Services 15
IT 8
Retail / E-commerce 7
NGOs / Associations 6
Transportation / Travel / Logistics 6
Construction / Real Estate 5
null 3
Telecommunications 3
Hospitality / Food & Beverage / Tourism 3
Energy 2
Agriculture / Food 1

Typical Attacks (9)

▼

MITRE ATT&CK does not currently catalogue Rhysida, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: rhysida executes malicious commands via PowerShell scripts to stage payloads and manipulate system behavior.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

What they do: rhysida modifies registry run keys to ensure malware execution upon system reboot for persistence.

What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
T1685 Disable or Modify Tools Defense Impairment

What they do: rhysida disables antivirus tools and security software to prevent detection and hinder incident response efforts.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1027.016 Junk Code Insertion Stealth

What they do: rhysida inserts junk code into legitimate binaries to evade static analysis and detection by security tools.

What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
T1070.004 File Deletion Stealth

What they do: rhysida deletes Volume Shadow Copies and backup directories via vssadmin and native commands to eliminate recovery options.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1018 Remote System Discovery Discovery

What they do: rhysida performs remote system discovery to identify additional hosts for lateral movement within the victim network.

What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1135 Network Share Discovery Discovery

What they do: rhysida scans network shares using Windows tools to identify victim files and expand foothold across the network.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1567.002 Exfiltration to Cloud Storage Exfiltration

What they do: rhysida exfiltrates stolen data via encrypted channels to pressure victims into paying ransom.

What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
T1486 Data Encrypted for Impact Impact

What they do: rhysida encrypts victim files using custom ransomware binaries targeting critical data across affected systems.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Tools Observed (8)

▼

Software Rhysida has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Discovery & enumeration

PowerView

Exfiltration

WinSCP

LOLBAS (living-off-the-land binaries)

NTDS Utility (ntdsutil) PsExec Windows Event Utility (wevtutil) WMIC

Offensive security tooling

Impacket

Remote monitoring & management

AnyDesk

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Ransom Notes (1)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

CriticalBreachDetected.txt txt · 1479 chars

Critical Breach Detected - Immediate Response Required

Dear company,

This is an automated alert from cybersecurity team Rhysida. An unfortunate situation has arisen - your digital ecosystem has been compromised, and a substantial amount of confidential data has been exfiltrated from your network. The potential ramifications of this could be dire, including the sale, publication, or distribution of your data to competitors or media outlets. This could inflict significant reputational and financial damage.

However, this situation is not without a remedy.

Our team has developed a unique key, specifically designed to restore your digital security. This key represents the first and most crucial step in recovering from this situation. To utilize this key, visit our secure portal: rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion with your secret key [snip]

It's vital to note that any attempts to decrypt the encrypted files independently could lead to permanent data loss. We strongly advise against such actions.

Time is a critical factor in mitigating the impact of this breach. With each passing moment, the potential damage escalates. Your immediate action and full cooperation are required to navigate this scenario effectively.

Rest assured, our team is committed to guiding you through this process. The journey to resolution begins with the use of the unique key. Together, we can restore the security of your digital environment.

Best regards

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (305)

Search, filter and paginate the victim timeline for Rhysida. Showing 1–100 of 305.

Type	Target	Discovered	Country	Business Category	Intel Link	Leak status
Ransomware	Reed & Giordano PA id33708 View details	2026-10-11	United States	—		pending
Reed & Giordano PA 94,604 files / ~51.3 GBACH instructions for the firm's client trust account (IOLTA) with complete account details; clients' wire-transfer details.PII: W-9/W-2 forms with SSNs, Massachusetts driver's licenses, birth certificate, personal UBS documents of a financial advisor.Client money flows (incoming/outgoing funds by case).Signed conflict-of-interest letter (matter - Alhassan) - a direct written admission of an internal firm problem. More ID 33708
Ransomware	Charles E. Tabor AAL LLC id33698 View details	2026-10-11	United States	—		pending
Charles E. Tabor AAL LLC 96,456 files / ~114.5 GBSettlement checks � 2026: $600,000 (USAA / Hailey), $587,500 (Travelers / Young), $350,000 (Caddo Parish School Board / Hoffman), $50,000 (USAA UM / Paul).Complete client database - PII for all cases spanning years, consolidated in a single file.Hospital and insurance scans across dozens of cases.Medical scans and HIPAA authorization forms.Driver's licenses and IDs of minor victims.Tax forms containing SSNs.Louisiana state death certificate (evidence item 'plaintiff's exhibit D7').Settlement artifacts: endorsement authorizations with signature lines (2026), signed releases, HIPAA authorizations.Scans of large settlement checks bearing signatures and MICR lines - a ready-made toolkit for check fraud; includes the $350,000 check from the high-profile child case Hoffman. More ID 33698
Ransomware	Gress Clark Young & Schoepper id33666 View details	2026-10-10	United States	—		pending
Gress Clark Young & Schoepper 167,804 files / ~166.4 GBBanking details - of the firm and its clients.SSNs + signatures of clients/witnesses; W-9, I-9 forms with DL/SSN card copies; W-4 forms.BIIA case-management procedures (Board of Industrial Insurance Appeals): default orders (Order of Default), internal 'Conference Questions', consulting-fee payments to experts.Firm finances: the firm's QuickBooks company file, VOID checks bearing signatures, expert-payment records, SaaS invoices.Medical photos and imaging; hundreds of pages of PHI/APF (Activity Prescription Forms) - X-rays, complete medical records.'Coaching' letters to doctors - including a letter to the physician in the Jachacy matter with wording indicative of steering a medical opinion ('coaching letter') - a potential ethics violation regarding witness handling.Credentials/access to the SPC e-file system (court e-filing).Disciplinary action against partner Daniel W. Gress. More ID 33666
Ransomware	Anne Arundel County id33613 View details	2026-10-09	United States	—		pending
Anne Arundel County Established in 1964, Anne Arundel County is a governmental body, consisting of numerous departments, services and sections all working together to serve the residents. This company is headquartered in Anne Arundel County, Maryland.814,500 files, 2.6 TB721 background-check dossiers with full SSNs in filenames, including 2026 records.Tens of thousands of medical faxes, 2022 to 2026, with patient names and diagnoses.Methadone clinic records under 42 CFR Part 2, the strictest US confidentiality regime.47,602 medical-assistance files with driver licenses, Green Cards, SSN cards, tax forms and bank data.County payroll registers with all salaries, HR memos, contracts, pension and discipline databases.Jail gang-intelligence files with a gang-member master list. More ID 33613
Ransomware	RealManage id33602 View details	2026-10-09	United States	—		pending
RealManage RealManage is a privately held, tech-enabled community association management company headquartered in Plano, Texas. Founded in 2002 and backed by American Securities, the company has grown into one of the largest and fastest-growing community association management firms in the United States, having been recognized on the Inc.1.84 TBThe tax, banking and debt secrets of hundreds of American HOAs and thousands of homeowners - complete with SSNs, account numbers and signatures.Genuine W-9 forms with Social Security numbers, addresses and signatures; IRS 1099-MISC/NEC e-file transmissions for 2014�2025 - thousands of vendor TINs/SSNsHomeowners' banking keys: ACH debit files with routing and account numbers, USAA brokerage statements, signed bank signature cardsPeople's debts by name: assessments through September 2026, bankruptcies, late-fee waivers, hardship letters from debtors begging for payment plansPersonal documents: HUD-1 home purchase settlements (names, prices, mortgages), signed waivers with addresses, HOA election ballots with voter namesFull SQL Server databases: RM_Warehouse, RM_Sales, RM_Portals, CiraNetIdentity (portal accounts), CiraBooks_GL (general ledger)Mail and document flow: CiraMail$, CiraDocs$, SalesDocs$ More ID 33602
Ransomware	Skaff Group id33435 View details	2026-10-03	Germany	Services		pending
Skaff Group SKAFF is a leader in Lebanon in the field of decorative fabrics. Files: 139,377Data volume: ~268 GB**Full HR dossiers - ~40 scans of Lebanese national ID cards (both sides + photos), a director's passport, civil-status extracts.Banking data - employee account files at Byblos Bank (named per person), Cedrus Bank corporate card program with banker contacts, account statements.Payroll violations - unpaid-salary analysis file, payroll module source code, staff leave requests.Employees' private lives - family photo archives on the work server.Commerce � price lists, Four Seasons and Les Galeries proposals, customs/export documents (Dubai, Erbil), customer claims. More ID 33435
Ransomware	Mat Bao Corporation id33417 View details	2026-10-02	Viet Nam	null		pending
Mat Bao Corporation Mat Bao Corporation offers a range of services including domain registration, cloud hosting, professional email solutions, and cloud server storage. Files: 746,108Data volume: 106.8 GBGovernment inspection materials - NEAC inspection decision No. 61/QD (29.04.2025) against the certification authority, working minutes naming state inspectors and company staff (through December 2025).Corporate core - GPKD business-registration documents bearing the owner's signature, shareholder records, tax commitments (January 2026).Personal data - national ID cards (CCCD) and employee passports with signatures, staff lists.Regulator correspondence - VNNIC, NEAC, the Government Cipher Committee (including RSA-1024 token vulnerabilities).Litigation and operations - the VINASEED dispute, internal investigations, operations-department mail. More ID 33417
Ransomware	Electro Heat Sweden AB id33415 View details	2026-10-02	Sweden	Manufacturing / Engineering		pending
Electro Heat Sweden AB ElectroHeat industrial furnaces are used in manufacturing industries all over the world.Files: 1,723,527Data volume: 2,55 TBAll intellectual property - SolidWorks CAD designs of every product, backups of the PDM drawing vault.All accounting and payroll - Visma databases and SPCS payroll databases of four legal entities.Legally sensitive material - confidential settlement agreement with ABB for a $75,000 payment, liquidated-damages dispute correspondence, cost-pricing calculations.Employee personal data - passport details, visa applications (passport, address, phone, DOB ), insurance policies.Contracts and acceptances - signed agreements and acceptance certificates with Hitachi, ABB, Scania and other customers. More ID 33415
Ransomware	clicks digital GmbH Information id33334 View details	2026-09-30	Germany	IT		leaked
clicks digital GmbH Information With more than 40 employees, the agency manages national and international online projects of companies from a wide range of industries. Based in Berlin, Dresden, Munich and Cologne, has been a specialist in online marketing for more than twelve years. More ID 33334
Ransomware	Law Offices of R. David Williams, P.A. id33331 View details	2026-09-30	United States	Finance / Legal / Insurance		pending
Law Offices of R. David Williams, P.A. Contents. A complete dossier of the firm's criminal defense practice covering ~175+ clients: felonies (an undercover sex sting involving a minor - Ramirez; domestic violence robbery - Valderrama, involving a 4-year-old child; felony DUI - Segula; fraud - B. Williams), a core caseload of ~10 DUI matters (including an arrest at breath readings of 0.011 and SCRAM alcohol monitoring), violations of probation (VOP), FDLE expungement packets with FD-258 fingerprint cards, a 'red flag' Risk Protection Order (RPO), 2 clients in ICE custody, and a material witness under GPS monitoring for 3+ years. Attorney fees range from $750 to $25,000. The case files include complete police discovery: ~206 GB of bodycam video, 911 recordings, and jail calls, incident reports, photo line-ups, FCIC/NCIC forms, and victim and witness data (Marsy's Law). More ID 33331
Ransomware	NEAD Pro id33154 View details	2026-09-24		null		pending
NEAD Pro Nead Pro is a professional multidisciplinary firm based in Gorizia and Udine, Italy, that provides legal, tax, bankruptcy, and accounting consulting services.What it is: a network share belonging to two Italian professional firms located at Via Roma 20, Gorizia (Friuli-Venezia Giulia):NEAD SRL (NORTH EAST ADVISORS S.R.L.) - an accounting firm, dottore commercialista, P.IVA 01114220310, REA GO-72906;NEAD PRO - PROFESSIONISTI RIUNITI - a law firm, P.IVA 01157140318.Volume: ~575,000 files / ~253 GB. The root contains a single branch Nuova directory\NEAD\ (plus an empty Documenti folder and a scatter of PDF scans at the root level).Structure and contents:Branch Volume ContentsNEAD PRO SITE - Documenti 231,137 files / 193.5 GB Law firm: 03.PRATICHE (46,620 files: CIVILE 9,665, PENALE 537, SOVRAINDEBITAMENTO 1,208), 04. INCARICHI (85,321: FALLIMENTI 22,492, ESECUZIONI 28,509, ADS 14,547, TRUST, CURATELE), SEGRETERIA with CREDENZIALI VARIE.xlsx (~40 firm accounts: SPID, PEC, banks, 2 cards with full PAN+CVC, safe code), bank scans (BANCOMAT PIN, BCC agreements)NEAD SRL SITE - Documenti 101,125 / 55.3 GB Accounting firm: 03.CLIENTI - 199 active + 184 former client folders (730, CU, F24, contracts), 44 private SOGEI Entratel .P12 keys (signing clients' tax returns), ISA/IRAP tax filings 2019�2020, client master data, Account.xlsxPRIMA NOTA - Documenti 1,885 / 871 MB Cash books 2019�2026 (21 xlsx): CASSA / CONTO CORRENTE / POS / CARTA / SISTERPOWERBI - Documenti 548 / 627 MB 37 financial BI models .pbix (BI_ISIDE, BI_NEAD, ATHENA, PNAI)ARCHIVIO 921 / 2.6 GB MPS bank statements 2020�2024, NEAD SRL account closure, firm mail archivePOSTA SARDAMAR / PANEGIOCHI / ISIDE / ADMIN SRL ~165+ / ~174 MB Client and firm mail: IVECO Capital leasing, accertamento Agenzia Entrate, Capitaneria di Porto, verbali poliziaES. IMM. 112-2024 10 files Real-estate enforcement proceedings (Tribunale di Gorizia): bank statements and CIE (ID cards) of auction participantsNEAD root ~85 PDF / 127 MB Scanned bank statements, F24 forms, IPZS envelope with the PIN/PUK of a CIE cardMost sensitive data: client dossiers with tax codes (codici fiscali), court case files (civil/criminal/bankruptcy), medical documents (Art. 9 GDPR), the firm's credential database with full PAN+CVC of two cards and the safe code, 52 Entratel electronic signature keys, ~100 SEPA mandates with IBANs and signatures, client PST archives (7.5 GB), a client's Huawei phone backup (Facebook/Gmail/Telegram databases), passports of foreign shareholders. More ID 33154
Ransomware	Legis id33120 View details	2026-09-23		null		pending
Legis Legis is a well-known Latin American publisher that creates specialized legal and business information resources. Founded over 60 years ago, the company serves professionals across six countries including Colombia, Venezuela, Argentina, Mexico, Peru, and Chile.DATABASES (SQL)PST/OSTLEGAL DOCUMENTS:Tutela - constitutional actions with claimants' personal dataID card copies (cedulas) of shareholders and third partiesEnvironmental sanction proceedings against the company (AUTO 10852)Sanction dispute with the pension authority (UGPP)Signed cease & desist - trademark dispute (Xpandia case)Personal data transfer agreements (Colsubsidio, Universidad Externado)Litigation log of all company lawsuitsContract matrix, payment agreements, reorganization documentsFINANCE & OWNERSHIP:Shareholder and ultimate-beneficial-owner register with ID copiesOwnership structure: ~99.94% held by a single ownerDividend payment recordsDebt write-off letters naming debtors and amountsFinancial and tax reporting (exogena, estados financieros)CUSTOMERS:Customer databases: law firms, universities, government contractorsIncluding Ecopetrol, Halliburton, the AIM state agency, hundreds of companiesTax IDs (NIT), contacts, contract history More ID 33120
Ransomware	Kreishandwerkerschaft Borken id32995 View details	2026-09-19	Germany	Manufacturing / Engineering	—	pending
Kreishandwerkerschaft Borken ID 32995
Ransomware	MPA Pharma id32966 View details	2026-09-18	Germany	Healthcare / Pharma		leaked
MPA Pharma MPA Pharma GmbH is an internationally active, rapidly growing company specializing in the import and trade of high-quality pharmaceuticals, including both patented and generic products. 2,899,290 files, ~5.8 TBPharmaceutical companyCategories: accounting records and database backups, government audits (customs / corporate tax / social security / wage tax),corporate ownership (nominee structure, beneficial-ownership filings, related-party payments), narcotics/BtM records (opioids, cannabis, precursors),litigation files, executive and employee personal data, IT artifacts, pharmacovigilance correspondence.Credit cards with CVV of executives, Oltersdorf ID card valid until 2030, the Pfeiffer letter on the hidden Paranova Pack B.V., UBO passportsSQL backups (17.7 million general-ledger rows), commercial register extract (HRB), organizational chartCredentials (TIER 1) - a list of all password files (values not repeated here, stored in the MPA PASSWORDS report)Government audits - customs 17,011.77 EUR with a breakdown, corporate tax +202,203.18 EUR, social security (DRV) 23,134.96 EUR with a separate case against the managing director, wage-tax auditNarcotics (BtM) - permits (318 04 74), reconciliations of 588 rows / 93 differences, fentanyl, hydromorphone, oxycodone, tapentadol, unexplained remainders of 1-13 units, documentation gap 2017-2020, cannabis up to 22 percent THC, precursorsLitigation - MSD/Merck memo, settlement agreement, Amgros judgment 5,180,043.09 DKK, complaint to the Ministry of Health, arbitration filingPeople, security, pharmacovigilance, bulk financial recordsArtifacts - leadership phone book, employee medical documents, Eli Lilly 2025, AstraZeneca, rebate contracts, a list of all produced reports More ID 32966
Ransomware	Axdia International id32787 View details	2026-09-12	United States	Manufacturing / Engineering		leaked
Axdia International Axdia International is a German electronics company that brings together a wide range of modern small electronics and electric mobility products. More ID 32787
Ransomware	General Santos Doctors Hospital id32743 View details	2026-09-10	Philippines	Healthcare / Pharma		leaked
General Santos Doctors Hospital 3.502.636 files, total volume ~2.44 TBPatient data (PHI) � name-tagged scans across department shares (surgical pathology, hemodialysis charts, admission records), cancer-center dossiers with PhilHealth IDs, lab quotations incl. cancer-marker tests with birth dates, PhilHealth claims monitoring, neonatal (NICU) dataStaff and professionals � accredited physicians register (cell numbers, PRC licenses, PhilHealth IDs), named payroll workbooks (incl. the affiliated diagnostic center), HR dossiers, staff passport scans, drug-test filesMoney, audit and governance � audited financial statements personally signed by chairman/treasurer/CFO with BIR stamps, balance sheet, all bank accounts across six-plus banks, internal-audit memos on (cashier discrepancies and cash shortages), SEC stockholders' minutes, payroll bank-upload batches, related-party entities on the same sharesLeadership personal data � personal cell numbers of the president, hospital administrator and board members More ID 32743
Ransomware	Professional Retail Services id32744 View details	2026-09-10		Retail / E-commerce		leaked
Professional Retail Services Owner�s documents: employee evaluations, salary rates, bonuses, job offers, family documentsCFO�s documents: client credit reports, bankruptcy records, tax documents, father�s medical records (guardianship court case)Corporate financials: owner�s personal tax return, credit application, signed checks with MICR (BNB Bank)Corporate credit cards, drug testsMedical records, employee health insuranceAnd much more More ID 32744
Ransomware	SAD'S Interim id32674 View details	2026-09-08	France	—		leaked
SAD'S Interim Since 2000, SAD'S INTERIM has established itself as a key player in the temporary employment sector.Bank statements (relev�s) with SEPA credit transfersFactoring: invoice import batches, client receivables ledgers (encours) with EUR amounts and named clients, payment receipts (quittances)SQL backups of the BRANIPP ERP (the temp-workers payroll database)Payslips (bulletins de salaire) and payroll validation workbooksPermanent-staff employment contracts signed by the owners (Sadoun family)Temp-worker contracts, Pole Emploi attestationsPassports (EU and third-country nationals)CARTE BTP (construction-worker cards with photo and DOB)carte Vitale (health-insurance cards)RIB (bank account details)NIR (national insurance numbers)MDPH (disability recognition documents) More ID 32674
Ransomware	Rug & Home id32647 View details	2026-09-07	United States	Retail / E-commerce		leaked
Rug & Home Rug & Home is a leading destination in the USA for rugs, furniture, and home decor, offering a vast selection of unique designs and top brands.Database of 50,193 customers�full names, home addresses, email addresses, phone numbers, purchase amounts (CSV)~10,800 scans�signed delivery notes with customer addresses/phone numbersPlaintext passwords for ~60 B2B supplier portalsW-2, 1099, W-9 � tax forms with employees' and contractors' SSNsPayroll database for all employees (Sage EMPLOYEE/ESWAGE)Company bank details (First Citizens Bank deposits) and employee accounts (direct deposit)HR: background checks, terminations, workplace injuries, 401(k)And much more More ID 32647
Ransomware	Szechenyi Programiroda Nonprofit Kf id32406 View details	2026-09-01	Hungary	NGOs / Associations	—	pending
Szechenyi Programiroda Nonprofit Kf ID 32406
Ransomware	Valley Health Team id32236 View details	2026-08-28		—		leaked
Valley Health Team 9,056,196 files3.28 TBLarge SQL databases containing the clinic's entire lifetime of information.Major databases:160,870 patients4.18 million diagnoses7.6 million unencrypted EHR scansSSN, passports, and other personal data.Financial statements, salaries, taxes.Dear customers, please submit your requests�there are plenty of files here that can be monetized. More ID 32236
Ransomware	Berlin, Germany id32233 View details	2026-08-28	Germany	—		leaked
Berlin, Germany Total capacity 5.79 TBArchive scale: ~1.44 million files scanned; by category � Maps/Geo 124,823, Legal/complaints 77,939, Financial 55,553, Contracts 46,522, HR 27,299,Government supervisory 13,142, Confidential 11,777, Infrastructure 8,110, Passwords 5,941, Health 2,738, Contacts 2,287.PII leak: 16,389 e-mails, 11,963 phone numbers, 12,076 individuals, 148 IBANs.Credentials in plaintext: Geb�udeAtlas, the ePayment PAYONE payment database, personal 'password safes' (danz, kramell � Z_ADMIN database accounts, franssen), leadership credentials.Disciplinary proceedings: the ANDERSON case (432 files, 2025�2026, lawsuit at VG Berlin administrative court), the politically motivated misconduct case involving the LKA Staatsschutz (state security police), the forestry cases BLAUTH/M�LLER/FIELICKE.State secrets: Bundesrat committee protocols with declassification correspondence, Geheimschutz (classified-material handling) data.Passports/IDs (recent, from personnel files and GI-Vertraulich).KRITIS: vulnerability analyses of Berlin's water supply.Mass personal data: Personalakten (personnel files) >5,000, Convotis payroll, OWi (administrative-offence) files >5,000, Postbuch SQL dumps 2020�2026, PST archives, leadership private data (IBANs, ID cards, Behrendt's bank card).NDA: 3,226 documentsLegal violation map (GDPR Art. 32/9/33, VSA/StGB upon VS classification confirmation, BSIG/KRITIS) More ID 32233
Ransomware	CRI Electric id31956 View details	2026-08-22	United States	—		leaked
CRI Electric CRI Electric is a veteran-owned business based in San Antonio, providing professional electrical services since 1998. They cater to both residential and commercial clients, offering services such as emergency electrical repairs, EV charger installations, and home rewiring. We are pleased to present:Employee's federal account artifacts (`HR-Confidential\Israel's Forms`): Login.gov personal recovery key (VA identity), TSP (retirement savings), ID.me, DoD DS Logon, PIEE (DoD contract payments)151 vendor W-9 forms (SSN/EIN), payroll docs, HR-lawyer (privileged) correspondence, OSHA-adjacent injury/incident reports with photos.Public-sector bid pricing** (2025�2026: SAWS HQ EV charging, SAISD, NISD) � bid-competitiveness and Davis-Bacon certified-payroll context.Corporate docs (SDVOSB certification, Articles, bylaws, stock ledgers), QuickBooks financials, a Power of Attorney More ID 31956
Ransomware	Coming soon id31965 View details	2026-08-21		—		leaked
Coming soon Total capacity 5.79 TBLegal/Complaints/Offenses 77,939 OWi proceedings, lawsuits, legal opinionsFinance 55,553 Budget, invoices, ProFISKAL, debt collectionContracts 46,522 Contracts, NDAs, procurementHR/Personnel 27,299 Personnel files, payroll, performance reviewsOversight/Government 13,142 Inquiries from the House of Representatives, GWTVConfidential-Secret 11,777 GI-Confidential folders, security classificationInfrastructure/Critical Information Infrastructure 8,110 KRITIS, risk analysis, emergency plansPasswords/secrets 5,941 files containing login credentialsHealth/insurance 2,738 medical benefitsContacts/Addresses 2,287 address databases, phone listsExtracted from the content: 16,389 unique email addresses, 11,963 phone numbers, 12,076 individuals with names, 148 IBANs, 820+ monetary amounts (up to �30 million).And a wealth of other valuable data. More ID 31965
Ransomware	Fairview Dental Group id31968 View details	2026-08-21	United States	—		pending
Fairview Dental Group Fairview Dental Group offers a range of dental services including family dentistry, cosmetic treatments, dental implants, and invisible braces.We are pleased to present:Full patient database, patient X-rays, scanned forms/consents/invoices, health records (PHI) of the entire practice, unencrypted. More ID 31968
Ransomware	Battle Creek Public Schools id31970 View details	2026-08-21	United States	—		leaked
Battle Creek Public Schools Battle Creek Public Schools in Nebraska provides educational services for students from pre-kindergarten through 12th grade. We are pleased to present:Student records of named minors:** IEP/special-ed files, disability determination notices, discipline/suspension records.Federal funds compliance trail (ESSA/Title I application), staff health-spending claims (payflex/EHA) More ID 31970
Ransomware	Pierce Township id31710 View details	2026-08-14	United States	Public Sector		leaked
Pierce Township Pierce Township is a growing community in Ohio that blends rural charm with suburban living, covering 23.5 square miles and home to over 16,000 residents.We are pleased to present:Judicial materials - Grand Jury subpoena response incl. hospital records (Mercy Hospital), public records requests, fire investigation reportsEmployee PII - Social Security numbers (SSA-1945, W-4, Ohio Tax forms), CDL licenses, health insurance waivers, new-hire packetsLegal settlements - Logan Creek v. Pierce Township, Purdue opioid settlement, easement and lease agreementsFinancial records - budgets, tax levies, appropriation reports, invoices, paymentsInternal email archives of township officials and administration More ID 31710
Ransomware	SIA Medical Centre id31666 View details	2026-08-13	Australia	Healthcare / Pharma		pending
SIA Medical Centre SIA Medical was established in 1993 and was founded by Dr Martin Sia in Melbourne's northwest. 9 clinics - Box Hill, Burwood, Croydon, Essendon, Footscray, Moonee Ponds, Montrose, Mulgrave and Berwick.We are pleased to present:~20,000 patient medical records - names, dates of birth, Medicare numbers, clinical notes, insurance and work-cover files, full patient dossiersStaff identity documents - passports, driver's licenses, police checks, tax file declarations of doctors and employeesPlaintext credentials - logins and passwords for clinical systems (Synapse imaging, PRODA, terminal server, doctor accounts)HR records - signed employment contracts, staff incident reports, immunisation registersLegal & financial - subpoenas, complaints, Bupa contracts, bank details (BSB/ABN), provider payment forms More ID 31666
Ransomware	Lawson Roofing id29977 View details	2026-06-18		Construction / Real Estate	—	pending
Lawson Roofing ID 29977
Ransomware	IDS Group id29519 View details	2026-05-25	United States	Services		leaked
IDS Group IDS Group is an award-winning multi-discipline design, engineering, and management consulting firm based in Southern California. More ID 29519
Ransomware	Landeshauptstadt Stuttgart id29258 View details	2026-05-19	Germany	Public Sector	—	pending
Landeshauptstadt Stuttgart Stuttgart is the capital city of Baden-Wurttemberg in southwestern Germany. ID 29258
Ransomware	Tower View Primary School id29170 View details	2026-05-15	United Kingdom	Education	—	pending
Tower View Primary School Tower View Primary School is an educational institution that serves approximately 380 pupils across 14 classes. ID 29170
Ransomware	Stelia North America id28583 View details	2026-04-27	United States	Manufacturing / Engineering	—	pending
Stelia North America ID 28583
Ransomware	Southold Town Senior ServicesSouthold Police Department id26970 View details	2026-03-02		Public Sector	—	pending
Southold Town Senior ServicesSouthold Police Department The Town of Southold, New York provides various government services including forms and permits, online payments, and notifications for residents. Southold Police Department is a company that operates in the Local industry. ID 26970
Ransomware	Rohner id26735 View details	2026-02-23	Switzerland	Manufacturing / Engineering	—	pending
Rohner Rohner designs and builds high-quality, custom paint booths and manufactured industrial paint systems. Our quality and service, cutting-edge technology, and engineering experience provide the best value in the finishing equipment industry. ID 26735
Ransomware	Cheyenne & Arapaho Tribes id26632 View details	2026-02-17	United States	Public Sector	—	pending
Cheyenne & Arapaho Tribes The Cheyenne and Arapaho Tribes are a federally recognized united nation of two distinct peoples-the Tsistsistas (Cheyenne) and Hinono'ei (Arapaho)-with a historic alliance formed in the early 19th century. ID 26632
Ransomware	Phoenix Art Museum id26463 View details	2026-02-12	United States	Other	—	pending
Phoenix Art Museum Phoenix Art Museum is an art museum that showcases art from around the U.S. in Phoenix, Arizona. ID 26463
Ransomware	Leading Edge Speciali id26237 View details	2026-02-06		Other	—	pending
Leading Edge Speciali ID 26237
Ransomware	Lakeside Union School District id26102 View details	2026-02-04	United States	Education	—	pending
Lakeside Union School District ID 26102
Ransomware	Elabs id26075 View details	2026-02-02	Sweden	Services	—	pending
Elabs Elabs is a pioneer in IT services in Germany, delivering innovative IT solutions that enable businesses to harness modern technology for added value and transformation. ID 26075
Ransomware	MACT Health Board id25909 View details	2026-01-29	United States	Healthcare / Pharma	—	pending
MACT Health Board ID 25909
Ransomware	Cytek Biosciences id25762 View details	2026-01-25	United States	Services		leaked
Cytek Biosciences Cytek Biosciences is a leading cell analysis solutions company founded in 1992 and headquartered in Fremont, California with global offices across North America, Europe, and Asia. Sold 0% All data was sold, stay with us, we will upload new Companies later More ID 25762
Ransomware	Jet-care International id25673 View details	2026-01-21	Switzerland	Services	—	pending
Jet-care International ID 25673
Ransomware	Charles Leonard Steel Services id25342 View details	2026-01-06	United States	Manufacturing / Engineering	—	pending
Charles Leonard Steel Services ID 25342
Ransomware	Falk, Waas, Hernandez, Cortina, Solomon & Bonner Overview Metrics id25222 View details	2025-12-30	United States	Other	—	pending
Falk, Waas, Hernandez, Cortina, Solomon & Bonner Overview Metrics ID 25222
Ransomware	Larry Pitt & Associates id24914 View details	2025-12-19	United States	Other	—	pending
Larry Pitt & Associates ID 24914
Ransomware	YOKOSUKA GAKUIN id24798 View details	2025-12-15	Japan	Other	—	pending
YOKOSUKA GAKUIN ID 24798
Ransomware	*** ********* id24750 View details	2025-12-13		Other	—	pending
*** ********* ID 24750
Ransomware	United Keetoowah Band of Cherokee Indians in Oklahoma id24732 View details	2025-12-12	United States	Other	—	pending
United Keetoowah Band of Cherokee Indians in Oklahoma ID 24732
Ransomware	Woodard, Emhardt, Henry, Reeves & Wagner, LLP id24706 View details	2025-12-11	United States	Other	—	pending
Woodard, Emhardt, Henry, Reeves & Wagner, LLP ID 24706
Ransomware	Harbour Town Doctors id24698 View details	2025-12-11	Australia	Healthcare / Pharma	—	pending
Harbour Town Doctors ID 24698
Ransomware	Kane's Furniture id24533 View details	2025-12-07	United States	Other	—	pending
Kane's Furniture ID 24533
Ransomware	SODISE id24475 View details	2025-12-06	France	Other	—	pending
SODISE ID 24475
Ransomware	Bo Beuckman Ford id24407 View details	2025-12-03	United States	Other	—	pending
Bo Beuckman Ford ID 24407
Ransomware	Cleveland County Sheriff's Office id24363 View details	2025-12-02	United States	Public Sector	—	pending
Cleveland County Sheriff's Office ID 24363
Ransomware	AGS id24242 View details	2025-11-26		Other	—	pending
AGS ID 24242
Ransomware	Marlex Human Capital id24198 View details	2025-11-25	Poland	Other	—	pending
Marlex Human Capital ID 24198
Ransomware	Collge Superieur De Montreal id24172 View details	2025-11-24	Canada	Other	—	pending
Collge Superieur De Montreal ID 24172
Ransomware	St. Joseph's Healthcare Hamilton id24137 View details	2025-11-22	Canada	Healthcare / Pharma	—	pending
St. Joseph's Healthcare Hamilton ID 24137
Ransomware	Wachusett School District MA id24087 View details	2025-11-21	United States	Education		pending
Wachusett School District MA Wachusett School District MA is a public school district. More ID 24087
Ransomware	Smoll & Banning, CPAs id23958 View details	2025-11-18	United States	Finance / Legal / Insurance	—	pending
Smoll & Banning, CPAs Smoll & Banning, CPA's, LLC is an independent accounting firm located in Dodge City, Kansas. ID 23958
Ransomware	Heart South Cardiovascular Group id23773 View details	2025-11-10	United States	Communication / Marketing		pending
Heart South Cardiovascular Group Heart South is a leading provider of comprehensive cardiac and vascular care in Central Alabama. More ID 23773
Ransomware	LMHT Associates id23759 View details	2025-11-10	United States	Other	—	pending
LMHT Associates ID 23759
Ransomware	KISS FM id23620 View details	2025-11-05	Spain	Communication / Marketing	—	pending
KISS FM Spanish radio station KISS FM, which broadcasts popular music and entertainment programs. The radio is available online, as well as traditionally on radio waves in Spain. The station is owned by the Spanish media group Mediaset Espana. ID 23620
Ransomware	Automated Logistics Systems id23591 View details	2025-11-04	United States	Transportation / Travel / Logistics	—	pending
Automated Logistics Systems ID 23591
Ransomware	Invacare id23587 View details	2025-11-04	United States	Healthcare / Pharma		pending
Invacare Invacare, founded in 1885 and headquartered out of Elyria, Ohio, is a manufacturer and distributor of home and long term care medical products. More ID 23587
Ransomware	Spindletop Center id23500 View details	2025-10-30	United States	Healthcare / Pharma	—	pending
Spindletop Center Spindletop Center is a non-profit healthcare organization focused on providing behavioral healthcare, as well as programs for individuals with intellectual and developmental disabilities and substance use recovery services. Over 100,000 patient records (address, phone number, passport number, social security number, diagnosis, medical history, etc.) ID 23500
Ransomware	Gemini Group id23449 View details	2025-10-28	United States	Services	—	pending
Gemini Group ID 23449
Ransomware	Bellflower Unified School District id23424 View details	2025-10-28	United States	Education		pending
Bellflower Unified School District Headquartered Bellflower, California, Bellflower Unified School District is a general education district that offers K-12 classes. More ID 23424
Ransomware	Abilene Family Medical Associates id23390 View details	2025-10-27	United States	Healthcare / Pharma	—	pending
Abilene Family Medical Associates ID 23390
Ransomware	Peraso id23267 View details	2025-10-21	Canada	Other	—	pending
Peraso ID 23267
Ransomware	Hematology Oncology Consultants id23182 View details	2025-10-17	United States	Communication / Marketing	—	pending
Hematology Oncology Consultants Michigan Hematology Oncology is a private practice dedicated to providing the highest level of quality care in a healing environment for the mind, body and spirit of patients dealing with cancer and blood disorders. ID 23182
Ransomware	GEIGER id23164 View details	2025-10-17	Germany	Communication / Marketing	—	pending
GEIGER GEIGER Antriebstechnik is a leading manufacturer of innovative mechanical and electric drive solutions for sun protection products such as blinds, awnings, and shutters, employing over 250 staff. ID 23164
Ransomware	Sibbalds id23144 View details	2025-10-16	United Kingdom	Services		pending
Sibbalds Sibbalds Chartered Accountants, based in Derby, specializes in providing a wide range of accountancy services to owner-managed businesses across England. More ID 23144
Ransomware	Tex-Tube id23135 View details	2025-10-15	United States	Manufacturing / Engineering	—	pending
Tex-Tube Tex Tube has over 75 years of experience in manufacturing steel products, specifically electric resistance welded (ERW) steel pipes, adhering to API and ASTM specifications. Serving the North American continent, the company produces tubular steel products that meet both API and ASTM standards. ID 23135
Ransomware	Furuno Electric id23013 View details	2025-10-13	Japan	Communication / Marketing	—	pending
Furuno Electric FURUNO strives to contribute to realisation of the pleasant society filled with safety and peace of mind by giving visual form to that previously invisible, such as underwater condition, situation around ships, accurate time, people's physical conditions, etc. ID 23013
Ransomware	Sdii Global id22921 View details	2025-10-09	United States	Manufacturing / Engineering	—	pending
Sdii Global Since 1989, Sdii Global has set the standard in forensic engineering and consulting, renowned for our expertise and unwavering commitment to excellence. ID 22921
Ransomware	JASCO Applied Sciences id22865 View details	2025-10-07	Canada	Other	—	pending
JASCO Applied Sciences ID 22865
Ransomware	Medstar Health id22805 View details	2025-10-04	United States	Healthcare / Pharma	—	pending
Medstar Health ID 22805
Ransomware	Peavey Electronics Corporation id22650 View details	2025-09-29	United States	Communication / Marketing	—	pending
Peavey Electronics Corporation Founded by Hartley Peavey in 1965 as a one-man shop, today Peavey Electronics Corporation is one of the largest makers and suppliers of musical instruments, amplifiers and professional audio systems in the world-distributing more than 2,000 products to more than 130 countries. ID 22650
Ransomware	The Maryland Department of Transportation id22562 View details	2025-09-24	United States	Transportation / Travel / Logistics	—	pending
The Maryland Department of Transportation ID 22562
Ransomware	Coastal Pacific Xpress id22251 View details	2025-09-10	Canada	Communication / Marketing	—	pending
Coastal Pacific Xpress ID 22251
Ransomware	Elite Trailers id22141 View details	2025-09-05	United States	Manufacturing / Engineering	—	pending
Elite Trailers Elite Trailer MFG, LLC. specializes in the custom manufacturing of high-quality trailers, including horse, livestock, and specialty models. ID 22141
Ransomware	Firelands Scientific id21997 View details	2025-08-28	United States	Other		pending
Firelands Scientific ID 21997
Ransomware	ZCORP id21984 View details	2025-08-27	United States	Communication / Marketing	—	pending
ZCORP ZCORP is a technology enterprise based in Princeton, NJ, specializing in providing innovative products, services, and tools to help clients navigate the challenges of a rapidly evolving marketplace. ID 21984
Ransomware	Elkhart Independent School District id21866 View details	2025-08-20	United States	Education		pending
Elkhart Independent School District Elkhart Independent School District is a public school district based in Elkhart, Texas (USA). The district is located in southwest Anderson County and extends into northern Houston County. More ID 21866
Ransomware	Trans-Tex id21699 View details	2025-08-12	Poland	Communication / Marketing	—	pending
Trans-Tex Trans-Tex has been the leader in narrow web dye sublimation printing for over 25 years. ID 21699
Ransomware	Alascom id21659 View details	2025-08-10	Italy	Telecommunications		pending
Alascom It has been operating for over 20 years as a system integrator and supplier of technical consulting services in the ICT and industrial automation sector with a fundamental knowledge of telecommunication networks and IP technologies. ID 21659
Ransomware	Cookeville Regional Medical Center id21658 View details	2025-08-02	United States	Healthcare / Pharma		pending
Cookeville Regional Medical Center At Cookeville Regional Medical Center, we are dedicated to providing the highest quality care to our patients and making a positive impact on our community. ID 21658
Ransomware	First Baptist Church of Hammond id21657 View details	2025-07-29	United States	Other		pending
First Baptist Church of Hammond Established in 1887, The First Baptist Church was listed as 2009's 12th largest church in America in Outreach magazine. ID 21657
Ransomware	Cardinal Services id21656 View details	2025-07-15	United States	Services		pending
Cardinal Services Cardinal Services was established by Bud and Gail Freeman in Coos Bay, Oregon in 1984, and we've been helping local business owners and job seekers achieve marketplace success ever since. ID 21656
Ransomware	Florida Hand Center id21655 View details	2025-07-08	United States	Healthcare / Pharma		pending
Florida Hand Center Florida Hand Center specializes in non-surgical and minimally invasive treatments for hand, wrist, and elbow conditions, serving patients in Punta Gorda, Port Charlotte, and Fort Myers, Florida. ID 21655
Ransomware	Welthungerhilfe id20885 View details	2025-06-29	Germany	Communication / Marketing		leaked
Welthungerhilfe Welthungerhilfe (WHH) is one of the largest private aid agencies in Germany; politically and religiously independent. More ID 20885
Ransomware	Coreix id21654 View details	2025-06-18	United Kingdom	IT		pending
Coreix Coreix Cloud Services Limited provides a wide range of cloud computing solutions including public cloud servers, dedicated servers, virtual private servers, and colocation services. ID 21654
Ransomware	CNPC USA id21653 View details	2025-06-16	United States	Other		leaked
CNPC USA CNPC USA Corporation is a Houston-based company that was founded in 2011 to help connect North America with CNPC's worldwide operations. ID 21653
Ransomware	Hudson River Housing id21652 View details	2025-06-07	United States	Construction / Real Estate		pending
Hudson River Housing Hudson River Housing provides quality, affordable rental housing for individual, families and seniors throughout the Mid-Hudson Valley region. ID 21652
Ransomware	Cator Ruma & Associates id21651 View details	2025-05-28	United States	Public Sector		pending
Cator Ruma & Associates Since our founding in 1959, Cator, Ruma & Associates has worked with many architects and clients to build thriving communities across the western and central United States. ID 21651
Ransomware	Carrera Chevrolet id21650 View details	2025-05-26	Brazil	Other		pending
Carrera Chevrolet ID 21650
Ransomware	Florida Lung id21649 View details	2025-05-20	United States	Healthcare / Pharma		pending
Florida Lung The Mission of Florida Lung, Asthma & Sleep Specialists is to be a leader in the provision of comprehensive medical care to patients with pulmonary disease, critical illness, allergic diseases and sleep disorders. ID 21649
Ransomware	Termolar id21648 View details	2025-05-18	Brazil	Communication / Marketing		pending
Termolar Termolar is the largest manufacturer of thermal conservation products in Latin America. ID 21648

Rhysida

Overview

Leak Status Distribution