rhysida
First seen June 5, 2023Active282 claimed victims
The claims below are reproduced as posted by rhysida on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Szechenyi Programiroda Nonprofit Kf | September 1, 2026 | ransomlook | — |
| Valley Health Team | August 28, 2026 | ransomlook | — |
| Berlin, Germany | August 28, 2026 | ransomware_live | — |
| CRI Electric | August 22, 2026 | ransomware_live | — |
| Battle Creek Public Schools | August 21, 2026 | ransomware_live | — |
| Fairview Dental Group | August 21, 2026 | ransomware_live | — |
| Coming soon | August 21, 2026 | ransomware_live | — |
| Pierce Township | August 14, 2026 | ransomware_live | — |
| SIA Medical Centre | August 13, 2026 | ransomware_live | — |
| Lawson Roofing | June 18, 2026 | ransomware_live | — |
| IDS Group | May 25, 2026 | ransomware_live | — |
| Landeshauptstadt Stuttgart | May 19, 2026 | ransomware_live | — |
| Tower View Primary School | May 15, 2026 | ransomware_live | — |
| Stelia North America | April 27, 2026 | ransomware_live | — |
| Southold Town Senior ServicesSouthold Police Department | March 2, 2026 | ransomware_live | — |
| Rohner | February 23, 2026 | ransomware_live | — |
| Cheyenne & Arapaho Tribes | February 17, 2026 | ransomware_live | — |
| Phoenix Art Museum | February 12, 2026 | ransomware_live | — |
| Leading Edge Speciali | February 6, 2026 | ransomware_live | — |
| Lakeside Union School District | February 4, 2026 | ransomware_live | — |
| Elabs | February 2, 2026 | ransomware_live | — |
| MACT Health Board | January 29, 2026 | ransomware_live | — |
| Cytek Biosciences | January 25, 2026 | ransomware_live | — |
| Jet-care International | January 21, 2026 | ransomware_live | — |
| Charles Leonard Steel Services | January 6, 2026 | ransomware_live | — |
| Falk, Waas, Hernandez, Cortina, Solomon & Bonner Overview Metrics | December 30, 2025 | ransomware_live | — |
| Larry Pitt & Associates | December 19, 2025 | ransomware_live | — |
| YOKOSUKA GAKUIN | December 15, 2025 | ransomware_live | — |
| ***** *********** | December 13, 2025 | ransomware_live | — |
| United Keetoowah Band of Cherokee Indians in Oklahoma | December 12, 2025 | ransomware_live | — |
| Harbour Town Doctors | December 11, 2025 | ransomware_live | — |
| Woodard, Emhardt, Henry, Reeves & Wagner, LLP | December 11, 2025 | ransomware_live | — |
| Kane's Furniture | December 7, 2025 | ransomware_live | — |
| SODISE | December 6, 2025 | ransomware_live | — |
| Bo Beuckman Ford | December 3, 2025 | ransomware_live | — |
| Cleveland County Sheriff's Office | December 2, 2025 | ransomware_live | — |
| AGS | November 26, 2025 | ransomware_live | — |
| Marlex Human Capital | November 25, 2025 | ransomware_live | — |
| Collge Superieur De Montreal | November 24, 2025 | ransomware_live | — |
| St. Joseph's Healthcare Hamilton | November 22, 2025 | ransomware_live | — |
| Wachusett School District MA | November 21, 2025 | ransomware_live | — |
| Smoll & Banning, CPAs | November 18, 2025 | ransomware_live | — |
| LMHT Associates | November 10, 2025 | ransomware_live | — |
| Heart South Cardiovascular Group | November 10, 2025 | ransomware_live | — |
| KISS FM | November 5, 2025 | ransomware_live | — |
| Invacare | November 4, 2025 | ransomware_live | — |
| Automated Logistics Systems | November 4, 2025 | ransomware_live | — |
| Spindletop Center | October 30, 2025 | ransomware_live | — |
| Bellflower Unified School District | October 28, 2025 | ransomware_live | — |
| Gemini Group | October 28, 2025 | ransomware_live | — |
| Abilene Family Medical Associates | October 27, 2025 | ransomware_live | — |
| Peraso | October 21, 2025 | ransomware_live | — |
| GEIGER | October 17, 2025 | ransomware_live | — |
| Hematology Oncology Consultants | October 17, 2025 | ransomware_live | — |
| Sibbalds | October 16, 2025 | ransomware_live | — |
| Tex-Tube | October 15, 2025 | ransomware_live | — |
| Furuno Electric | October 13, 2025 | ransomware_live | — |
| Sdii Global | October 9, 2025 | ransomware_live | — |
| JASCO Applied Sciences | October 7, 2025 | ransomware_live | — |
| Medstar Health | October 4, 2025 | ransomware_live | — |
| Peavey Electronics Corporation | September 29, 2025 | ransomware_live | — |
| The Maryland Department of Transportation | September 24, 2025 | ransomware_live | — |
| Coastal Pacific Xpress | September 10, 2025 | ransomware_live | — |
| Elite Trailers | September 5, 2025 | ransomware_live | — |
| Firelands Scientific | August 28, 2025 | ransomware_live | — |
| ZCORP | August 27, 2025 | ransomware_live | — |
| Elkhart Independent School District | August 20, 2025 | ransomware_live | — |
| Trans-Tex | August 12, 2025 | ransomware_live | — |
| Alascom | August 10, 2025 | ransomware_live | — |
| Cookeville Regional Medical Center | August 2, 2025 | ransomware_live | — |
| First Baptist Church of Hammond | July 29, 2025 | ransomware_live | — |
| Cardinal Services | July 15, 2025 | ransomware_live | — |
| Florida Hand Center | July 8, 2025 | ransomware_live | — |
| Welthungerhilfe | June 29, 2025 | ransomware_live | — |
| Coreix | June 18, 2025 | ransomware_live | — |
| CNPC USA | June 16, 2025 | ransomware_live | — |
| Hudson River Housing | June 7, 2025 | ransomware_live | — |
| Cator Ruma & Associates | May 28, 2025 | ransomware_live | — |
| Carrera Chevrolet | May 26, 2025 | ransomware_live | — |
| Florida Lung | May 20, 2025 | ransomware_live | — |
| Termolar | May 18, 2025 | ransomware_live | — |
| Sao Camilo Cachoeiro de Itapemirim | May 14, 2025 | ransomware_live | — |
| Mountain View Mushrooms | May 9, 2025 | ransomware_live | — |
| Mediprobe Research | May 5, 2025 | ransomware_live | — |
| Kalin Hobeltechnik | May 3, 2025 | ransomware_live | — |
| Government of Peru | May 1, 2025 | ransomware_live | — |
| Coop UQAM | April 29, 2025 | ransomware_live | — |
| LaBella Associates | April 28, 2025 | ransomware_live | — |
| MDB | April 26, 2025 | ransomware_live | — |
| Milicic | April 23, 2025 | ransomware_live | — |
| Acos Favorit | April 22, 2025 | ransomware_live | — |
| Oregon Department of Environmental Quality | April 15, 2025 | ransomware_live | — |
| Dimension Composite | April 12, 2025 | ransomware_live | — |
| Swiss Capitals Group | April 6, 2025 | ransomware_live | — |
| Clarity Ventures | April 2, 2025 | ransomware_live | — |
| Forrest City School District | March 28, 2025 | ransomware_live | — |
| Senior Support Services | March 27, 2025 | ransomware_live | — |
| Okeene Elementary School | March 25, 2025 | ransomware_live | — |
| Ted Hosmer Enterprises | March 18, 2025 | ransomware_live | — |
| Cothron's Security Professionals | March 14, 2025 | ransomware_live | — |
Page 1 of 3Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).