rhysida
First seen June 5, 2023Active303 claimed victims
The claims below are reproduced as posted by rhysida on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Kiemle-Hankins | June 15, 2024 | ransomware_live | — |
| California Rice Exchange | June 8, 2024 | ransomware_live | — |
| Rob's Whole Health Pharmacy | May 30, 2024 | ransomware_live | — |
| ICC | May 22, 2024 | ransomware_live | — |
| Widdop & Co. | May 18, 2024 | ransomware_live | — |
| Surrey Place Healthcare & Rehabilitation | May 15, 2024 | ransomware_live | — |
| Unimed Vales do Taquari e Rio Pardo | May 8, 2024 | ransomware_live | — |
| Lopez Hnos | May 2, 2024 | ransomware_live | — |
| CDSHotels | April 26, 2024 | ransomware_live | — |
| Ministerio de Desarrollo Local | April 23, 2024 | ransomware_live | — |
| Oki Golf | April 12, 2024 | ransomware_live | — |
| Hernando County | April 12, 2024 | ransomware_live | — |
| Malaysian Industrial Development Finance | April 7, 2024 | ransomware_live | — |
| Seven Seas Technology | April 3, 2024 | ransomware_live | — |
| El Debate | March 26, 2024 | ransomware_live | — |
| Kolbe Striping | March 20, 2024 | ransomware_live | — |
| MarineMax | March 20, 2024 | ransomware_live | — |
| Brooks Tropicals | March 12, 2024 | ransomware_live | — |
| Ann & Robert H. Lurie Children's Hospital of Chicago | February 27, 2024 | ransomware_live | — |
| Ironrock | February 26, 2024 | ransomware_live | — |
| ASP BasilicataASM MateraIRCCS CROB | February 15, 2024 | ransomware_live | — |
| CNPC Peru S.A. | February 1, 2024 | ransomware_live | — |
| Lee Spring | January 13, 2024 | ransomware_live | — |
| The Lutheran World Federation | January 6, 2024 | ransomware_live | — |
| Aspiration Training | January 1, 2024 | ransomware_live | — |
| Tshwane University of Technology | December 26, 2023 | ransomware_live | — |
| Abdali Hospital | December 26, 2023 | ransomware_live | — |
| Kauno Technologijos Universitetas | December 19, 2023 | ransomware_live | — |
| Insomniac Games | December 12, 2023 | ransomware_live | — |
| Grupo Jose Alves | December 12, 2023 | ransomware_live | — |
| Hse | December 10, 2023 | ransomware_live | — |
| Holding Slovenske elektarne | December 10, 2023 | ransomware_live | — |
| Qatar Racing and Equestrian Club | December 9, 2023 | ransomware_live | — |
| Tcman | December 8, 2023 | ransomware_live | — |
| Travian Games | December 8, 2023 | ransomware_live | — |
| King Edward VII's Hospital | November 29, 2023 | ransomware_live | — |
| NC Central University | November 27, 2023 | ransomware_live | — |
| Bangkok University | November 27, 2023 | ransomware_live | — |
| Energy China | November 24, 2023 | ransomware_live | — |
| St Edmund's College & Prep School | November 21, 2023 | ransomware_live | — |
| British Library | November 20, 2023 | ransomware_live | — |
| MHM Health | November 11, 2023 | ransomware_live | — |
| Azienda Ospedaliera Universitaria Integrata di Verona | November 10, 2023 | ransomware_live | — |
| Indah Water Konsortium | November 7, 2023 | ransomware_live | — |
| Mount St. Mary's Seminary | November 6, 2023 | ransomware_live | — |
| SMH Group | November 5, 2023 | ransomware_live | — |
| GO! Handelsschool Aalst | November 2, 2023 | ransomware_live | — |
| Northwest Eye Care Professionals | October 14, 2023 | ransomware_live | — |
| Southern Arkansas University | October 9, 2023 | ransomware_live | — |
| Camara Municipal de Gondomar | October 6, 2023 | ransomware_live | — |
| General Directorate of Migration of the Dominican Republic | October 4, 2023 | ransomware_live | — |
| Federal University of Mato Grosso do Sul | October 2, 2023 | ransomware_live | — |
| Istituto Prosperius | September 26, 2023 | ransomware_live | — |
| Ministry Of Finance (Kuwait) | September 25, 2023 | ransomware_live | — |
| Ort Harmelin College of Engineering | September 23, 2023 | ransomware_live | — |
| Holon Institute of Technology | September 22, 2023 | ransomware_live | — |
| Core Desktop | September 10, 2023 | ransomware_live | — |
| Singing River Health System | September 10, 2023 | ransomware_live | — |
| IT-Center Syd | September 9, 2023 | ransomware_live | — |
| Prince George's County Public Schools | August 25, 2023 | ransomware_live | — |
| Prospect Medical Holdings | August 24, 2023 | ransomware_live | — |
| Pierce College | August 21, 2023 | ransomware_live | — |
| Municipality of Ferrara | August 16, 2023 | ransomware_live | — |
| National Institute of Social Services for Retirees and Pensioners | August 12, 2023 | ransomware_live | — |
| Ramtha | August 9, 2023 | ransomware_live | — |
| Optimum Health Solutions | August 9, 2023 | ransomware_live | — |
| United Tractors | August 3, 2023 | ransomware_live | — |
| Rouzbeh Educational Complex | July 28, 2023 | ransomware_live | — |
| ESKA Erich Schweizer | July 28, 2023 | ransomware_live | — |
| ESMOD | July 28, 2023 | ransomware_live | — |
| University of Salerno | July 26, 2023 | ransomware_live | — |
| University of the West of Scotland | July 25, 2023 | ransomware_live | — |
| Axity | July 22, 2023 | ransomware_live | — |
| Lumberton Independent School District | July 19, 2023 | ransomware_live | — |
| ICT-College | July 17, 2023 | ransomware_live | — |
| Stephen F. Austin State University | July 17, 2023 | ransomware_live | — |
| The Big Life group | July 14, 2023 | ransomware_live | — |
| Caterham High School | July 14, 2023 | ransomware_live | — |
| Citta Nuova | July 10, 2023 | ransomware_live | — |
| Kenya Bureau Of Standards | July 7, 2023 | ransomware_live | — |
| BM GROUP POLYTEC S.p.A. | July 3, 2023 | ransomware_live | — |
| Hollywood Forever | July 3, 2023 | ransomware_live | — |
| Ayuntamiento de Arganda City Council | July 3, 2023 | ransomware_live | — |
| Western National Group | June 29, 2023 | ransomware_live | — |
| Enfield Grammar School | June 29, 2023 | ransomware_live | — |
| Alberta Newsprint | June 28, 2023 | ransomware_live | — |
| Hochschule Kaiserslautern | June 27, 2023 | ransomware_live | — |
| iMatica | June 27, 2023 | ransomware_live | — |
| Fassi Gru S.p.A. | June 26, 2023 | ransomware_live | — |
| Avannubo | June 21, 2023 | ransomware_live | — |
| SAPROS | June 20, 2023 | ransomware_live | — |
| IRIS Informatique | June 19, 2023 | ransomware_live | — |
| Tyconz | June 18, 2023 | ransomware_live | — |
| EDER | June 18, 2023 | ransomware_live | — |
| Ziegelwerk Eder | June 17, 2023 | ransomware_live | — |
| Koper Automatisering | June 15, 2023 | ransomware_live | — |
| Northeastern State University | June 12, 2023 | ransomware_live | — |
| Paris High School | June 12, 2023 | ransomware_live | — |
| Ejercito de Chile | June 10, 2023 | ransomware_live | — |
| Collectivite Territoriale de Martinique | June 5, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).