rhysida
First seen June 5, 2023Active303 claimed victims
The claims below are reproduced as posted by rhysida on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Florida Lung | May 20, 2025 | ransomware_live | — |
| Termolar | May 18, 2025 | ransomware_live | — |
| Sao Camilo Cachoeiro de Itapemirim | May 14, 2025 | ransomware_live | — |
| Mountain View Mushrooms | May 9, 2025 | ransomware_live | — |
| Mediprobe Research | May 5, 2025 | ransomware_live | — |
| Kalin Hobeltechnik | May 3, 2025 | ransomware_live | — |
| Government of Peru | May 1, 2025 | ransomware_live | — |
| Coop UQAM | April 29, 2025 | ransomware_live | — |
| LaBella Associates | April 28, 2025 | ransomware_live | — |
| MDB | April 26, 2025 | ransomware_live | — |
| Milicic | April 23, 2025 | ransomware_live | — |
| Acos Favorit | April 22, 2025 | ransomware_live | — |
| Oregon Department of Environmental Quality | April 15, 2025 | ransomware_live | — |
| Dimension Composite | April 12, 2025 | ransomware_live | — |
| Swiss Capitals Group | April 6, 2025 | ransomware_live | — |
| Clarity Ventures | April 2, 2025 | ransomware_live | — |
| Forrest City School District | March 28, 2025 | ransomware_live | — |
| Senior Support Services | March 27, 2025 | ransomware_live | — |
| Okeene Elementary School | March 25, 2025 | ransomware_live | — |
| Ted Hosmer Enterprises | March 18, 2025 | ransomware_live | — |
| Cothron's Security Professionals | March 14, 2025 | ransomware_live | — |
| British virgin islands London Office | March 9, 2025 | ransomware_live | — |
| Best Collateral, Inc. | March 5, 2025 | ransomware_live | — |
| Newton & Associates, Inc | March 1, 2025 | ransomware_live | — |
| Peter Glenn Ski Sport | February 22, 2025 | ransomware_live | — |
| Buanderie Centrale de Montreal | February 18, 2025 | ransomware_live | — |
| The Agency | February 14, 2025 | ransomware_live | — |
| Town Counsel Law & Litigation | February 12, 2025 | ransomware_live | — |
| My New Jersey Dentist | February 12, 2025 | ransomware_live | — |
| BH Aircraft Company, Inc. | February 12, 2025 | ransomware_live | — |
| Hammond Trucking & Excavation | February 12, 2025 | ransomware_live | — |
| Leading Edge Specialized Dentistry | February 12, 2025 | ransomware_live | — |
| Pembina Trails School Division | January 31, 2025 | ransomware_live | — |
| Carthage Police Department | January 28, 2025 | ransomware_live | — |
| ORU Mabee Center | January 24, 2025 | ransomware_live | — |
| TG3 Electronics | January 19, 2025 | ransomware_live | — |
| The Chicano Federation | January 14, 2025 | ransomware_live | — |
| Qualinet | January 10, 2025 | ransomware_live | — |
| Sunflower Medical Group | January 7, 2025 | ransomware_live | — |
| Montreal North | January 4, 2025 | ransomware_live | — |
| T Smiles Dental | December 25, 2024 | ransomware_live | — |
| Avstar Fuel Systems | December 18, 2024 | ransomware_live | — |
| Rutherford County Schools | December 11, 2024 | ransomware_live | — |
| Matlock Security Services | December 7, 2024 | ransomware_live | — |
| Goodwill North Central Texas | December 3, 2024 | ransomware_live | — |
| Delmar International | November 29, 2024 | ransomware_live | — |
| Vermilion Parish School System | November 27, 2024 | ransomware_live | — |
| Bishop Ireton High School | November 20, 2024 | ransomware_live | — |
| American Addiction Centers | November 16, 2024 | ransomware_live | — |
| Fylde Coast Academy Trust | November 5, 2024 | ransomware_live | — |
| Hope Valley Recovery | November 1, 2024 | ransomware_live | — |
| De Rose Lawyers | October 25, 2024 | ransomware_live | — |
| Easterseals | October 23, 2024 | ransomware_live | — |
| Microworks | October 15, 2024 | ransomware_live | — |
| Henry County Schools | October 15, 2024 | ransomware_live | — |
| Axis Health System | October 10, 2024 | ransomware_live | — |
| Shenango Area School District | September 26, 2024 | ransomware_live | — |
| Greene Acres Nursing Home | September 20, 2024 | ransomware_live | — |
| Granite School District | September 20, 2024 | ransomware_live | — |
| Port of Seattle/Seattle-Tacoma International Airport (SEA) | September 18, 2024 | ransomware_live | — |
| Qeco/coeq | September 10, 2024 | ransomware_live | — |
| Pennsylvania State Education Association | September 9, 2024 | ransomware_live | — |
| Stratford School Academy | September 8, 2024 | ransomware_live | — |
| Daughterly Care | September 6, 2024 | ransomware_live | — |
| Project Hospitality | September 2, 2024 | ransomware_live | — |
| Sports & Spine Orthopaedics | August 31, 2024 | ransomware_live | — |
| White Mountain Backpacks | August 31, 2024 | ransomware_live | — |
| Corbally Gartland and Rappleyea | August 29, 2024 | ransomware_live | — |
| Affordable Tools | August 26, 2024 | ransomware_live | — |
| NewsBank | August 26, 2024 | ransomware_live | — |
| Engedi | August 22, 2024 | ransomware_live | — |
| Kronick Moskovitz Tiedemann & Girard | August 22, 2024 | ransomware_live | — |
| Plastics Plus | August 22, 2024 | ransomware_live | — |
| Olympus Financial | August 21, 2024 | ransomware_live | — |
| Waynesboro Nurseries | August 19, 2024 | ransomware_live | — |
| Sterling Rope | August 16, 2024 | ransomware_live | — |
| Liberty Resources | August 15, 2024 | ransomware_live | — |
| The Washington Times | August 14, 2024 | ransomware_live | — |
| The White Center Community Development Association | August 13, 2024 | ransomware_live | — |
| Moser Wealth Advisors | August 11, 2024 | ransomware_live | — |
| Sumter County Sheriff | August 9, 2024 | ransomware_live | — |
| Golden Age Nursing Home | August 9, 2024 | ransomware_live | — |
| Bayhealth Hospital | August 7, 2024 | ransomware_live | — |
| Maryville Academy | August 5, 2024 | ransomware_live | — |
| Ranney School | August 4, 2024 | ransomware_live | — |
| City of Columbus, Ohio | July 31, 2024 | ransomware_live | — |
| Computer Networking Solutions | July 27, 2024 | ransomware_live | — |
| New Jersey City University | July 27, 2024 | ransomware_live | — |
| Community Care Alliance | July 26, 2024 | ransomware_live | — |
| LawDepot | July 23, 2024 | ransomware_live | — |
| Queens County Public Administrator | July 20, 2024 | ransomware_live | — |
| Law Offices of the Public Defender - New Mexico | July 19, 2024 | ransomware_live | — |
| Gandara Center | July 17, 2024 | ransomware_live | — |
| Goede, DeBoest & Cross, PLLC. | July 15, 2024 | ransomware_live | — |
| BrownWinick | July 14, 2024 | ransomware_live | — |
| MYC Media | July 7, 2024 | ransomware_live | — |
| DRM Resources | June 29, 2024 | ransomware_live | — |
| Erivan Gecom Inc | June 22, 2024 | ransomware_live | — |
| CETOS Services | June 16, 2024 | ransomware_live | — |
| Production Machine & Enterprises | June 16, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).