rhysida
First seen June 5, 2023Active303 claimed victims
The claims below are reproduced as posted by rhysida on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Line2Line Coatings | October 23, 2026 | ransomlook | — |
| DR.SCHNELL GmbH & Co. KGaA | October 22, 2026 | ransomlook | — |
| Reed & Giordano PA | October 11, 2026 | ransomlook | — |
| Charles E. Tabor AAL LLC | October 11, 2026 | ransomlook | — |
| Gress Clark Young & Schoepper | October 10, 2026 | ransomlook | — |
| Anne Arundel County | October 9, 2026 | ransomlook | reported in press coverage |
| RealManage | October 9, 2026 | ransomlook | — |
| Skaff Group | October 3, 2026 | ransomlook | — |
| Mat Bao Corporation | October 2, 2026 | ransomlook | — |
| Electro Heat Sweden AB | October 2, 2026 | ransomlook | — |
| clicks digital GmbH Information | September 30, 2026 | ransomlook | — |
| Law Offices of R. David Williams, P.A. | September 30, 2026 | ransomlook | — |
| NEAD Pro | September 24, 2026 | ransomlook | — |
| Legis | September 23, 2026 | ransomlook | — |
| Kreishandwerkerschaft Borken | September 19, 2026 | ransomlook | — |
| MPA Pharma | September 18, 2026 | ransomlook | — |
| Axdia International | September 12, 2026 | ransomlook | — |
| Professional Retail Services | September 10, 2026 | ransomlook | — |
| General Santos Doctors Hospital | September 10, 2026 | ransomlook | — |
| SAD'S Interim | September 8, 2026 | ransomlook | — |
| Rug & Home | September 7, 2026 | ransomlook | — |
| Szechenyi Programiroda Nonprofit Kf | September 1, 2026 | ransomlook | — |
| Valley Health Team | August 28, 2026 | ransomlook | — |
| Berlin, Germany | August 28, 2026 | ransomware_live | — |
| CRI Electric | August 22, 2026 | ransomware_live | — |
| Battle Creek Public Schools | August 21, 2026 | ransomware_live | — |
| Fairview Dental Group | August 21, 2026 | ransomware_live | — |
| Coming soon | August 21, 2026 | ransomware_live | — |
| Pierce Township | August 14, 2026 | ransomware_live | — |
| SIA Medical Centre | August 13, 2026 | ransomware_live | — |
| Lawson Roofing | June 18, 2026 | ransomware_live | — |
| IDS Group | May 25, 2026 | ransomware_live | — |
| Landeshauptstadt Stuttgart | May 19, 2026 | ransomware_live | — |
| Tower View Primary School | May 15, 2026 | ransomware_live | — |
| Stelia North America | April 27, 2026 | ransomware_live | — |
| Southold Town Senior ServicesSouthold Police Department | March 2, 2026 | ransomware_live | — |
| Rohner | February 23, 2026 | ransomware_live | — |
| Cheyenne & Arapaho Tribes | February 17, 2026 | ransomware_live | — |
| Phoenix Art Museum | February 12, 2026 | ransomware_live | — |
| Leading Edge Speciali | February 6, 2026 | ransomware_live | — |
| Lakeside Union School District | February 4, 2026 | ransomware_live | — |
| Elabs | February 2, 2026 | ransomware_live | — |
| MACT Health Board | January 29, 2026 | ransomware_live | — |
| Cytek Biosciences | January 25, 2026 | ransomware_live | — |
| Jet-care International | January 21, 2026 | ransomware_live | — |
| Charles Leonard Steel Services | January 6, 2026 | ransomware_live | — |
| Falk, Waas, Hernandez, Cortina, Solomon & Bonner Overview Metrics | December 30, 2025 | ransomware_live | — |
| Larry Pitt & Associates | December 19, 2025 | ransomware_live | — |
| YOKOSUKA GAKUIN | December 15, 2025 | ransomware_live | — |
| ***** *********** | December 13, 2025 | ransomware_live | — |
| United Keetoowah Band of Cherokee Indians in Oklahoma | December 12, 2025 | ransomware_live | — |
| Harbour Town Doctors | December 11, 2025 | ransomware_live | — |
| Woodard, Emhardt, Henry, Reeves & Wagner, LLP | December 11, 2025 | ransomware_live | — |
| Kane's Furniture | December 7, 2025 | ransomware_live | — |
| SODISE | December 6, 2025 | ransomware_live | — |
| Bo Beuckman Ford | December 3, 2025 | ransomware_live | — |
| Cleveland County Sheriff's Office | December 2, 2025 | ransomware_live | — |
| AGS | November 26, 2025 | ransomware_live | — |
| Marlex Human Capital | November 25, 2025 | ransomware_live | — |
| Collge Superieur De Montreal | November 24, 2025 | ransomware_live | — |
| St. Joseph's Healthcare Hamilton | November 22, 2025 | ransomware_live | — |
| Wachusett School District MA | November 21, 2025 | ransomware_live | — |
| Smoll & Banning, CPAs | November 18, 2025 | ransomware_live | — |
| LMHT Associates | November 10, 2025 | ransomware_live | — |
| Heart South Cardiovascular Group | November 10, 2025 | ransomware_live | — |
| KISS FM | November 5, 2025 | ransomware_live | — |
| Invacare | November 4, 2025 | ransomware_live | — |
| Automated Logistics Systems | November 4, 2025 | ransomware_live | — |
| Spindletop Center | October 30, 2025 | ransomware_live | — |
| Bellflower Unified School District | October 28, 2025 | ransomware_live | — |
| Gemini Group | October 28, 2025 | ransomware_live | — |
| Abilene Family Medical Associates | October 27, 2025 | ransomware_live | — |
| Peraso | October 21, 2025 | ransomware_live | — |
| GEIGER | October 17, 2025 | ransomware_live | — |
| Hematology Oncology Consultants | October 17, 2025 | ransomware_live | — |
| Sibbalds | October 16, 2025 | ransomware_live | — |
| Tex-Tube | October 15, 2025 | ransomware_live | — |
| Furuno Electric | October 13, 2025 | ransomware_live | — |
| Sdii Global | October 9, 2025 | ransomware_live | — |
| JASCO Applied Sciences | October 7, 2025 | ransomware_live | — |
| Medstar Health | October 4, 2025 | ransomware_live | — |
| Peavey Electronics Corporation | September 29, 2025 | ransomware_live | — |
| The Maryland Department of Transportation | September 24, 2025 | ransomware_live | — |
| Coastal Pacific Xpress | September 10, 2025 | ransomware_live | — |
| Elite Trailers | September 5, 2025 | ransomware_live | — |
| Firelands Scientific | August 28, 2025 | ransomware_live | — |
| ZCORP | August 27, 2025 | ransomware_live | — |
| Elkhart Independent School District | August 20, 2025 | ransomware_live | — |
| Trans-Tex | August 12, 2025 | ransomware_live | — |
| Alascom | August 10, 2025 | ransomware_live | — |
| Cookeville Regional Medical Center | August 2, 2025 | ransomware_live | — |
| First Baptist Church of Hammond | July 29, 2025 | ransomware_live | — |
| Cardinal Services | July 15, 2025 | ransomware_live | — |
| Florida Hand Center | July 8, 2025 | ransomware_live | — |
| Welthungerhilfe | June 29, 2025 | ransomware_live | — |
| Coreix | June 18, 2025 | ransomware_live | — |
| CNPC USA | June 16, 2025 | ransomware_live | — |
| Hudson River Housing | June 7, 2025 | ransomware_live | — |
| Cator Ruma & Associates | May 28, 2025 | ransomware_live | — |
| Carrera Chevrolet | May 26, 2025 | ransomware_live | — |
Page 1 of 4Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).