rhysida
ransomware group · aka Rhysida, Rhysida ransomware, possible Vice Society overlap (suspected by some vendors, unconfirmed) · unknown; no confirmed attribution. Some vendor reporting (2023) suggested tooling or operational overlap with the Vice Society actor based on shared TTPs, but a direct link remains unconfirmed. · active since May 2023 (per vendor research)
Victims · 7d
3▲1 vs prev. week
Victims · 30d
12active targets
Victims · 90d
15
All-time (tracked)
288since 2023-06-09
Last post
09-12 15:39UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Rhysida is a ransomware and double-extortion group first publicly observed in May 2023, operating an affiliate-style model and publishing stolen data on a Tor leak site. It is known for high-profile attacks on public-sector and critical-service targets, including Prospect Medical Holdings, the British Library, and the Chilean Army (all 2023). Several researchers have suggested overlap with the Vice Society actor, citing shared tactics such as intermittent encryption, though this remains unconfirmed. Per this dashboard, the group's leak site posted 2 victims in the past 30 days, most recently on 2026-09-08, including publication of stolen Berlin state government login credentials after a reported €2 million extortion demand was refused (news reporting, 2026). No comprehensive public earnings estimate for the group has been identified.
Tactics & tooling
- Initial access via phishing emails with malicious links or attachments (vendor reporting, 2023)
- Use of legitimate remote monitoring/management and remote-access tools in intrusions
- Double extortion: data exfiltration followed by publication on a Tor leak site
- Public auctions of stolen victim data on cybercrime markets (reported 2023, e.g., Prospect Medical Holdings)
- C-based ransomware encryptor using ChaCha20 for file encryption with RSA-4096-protected keys (analyst analyses, 2023)
- Intermittent/partial encryption in some incidents, a technique also associated with the Vice Society actor
- Recruitment of affiliates via cybercrime forums (reported 2023)
- Targeting skewed toward healthcare, education, government, and cultural institutions, though activity is opportunistic
Targeted sectors
HealthcareEducation and cultural institutionsGovernment and public sectorPublic health agenciesMultiple verticals (opportunistic)
Notable public victims
Prospect Medical Holdings (US healthcare; 2023; breach and reported data auction covered by media/vendor reporting), British Library (UK; 2023; reported £600,000 (~$750,000) demand refused; data published), Chilean Army (2023), Southern Nevada Health District (US; 2023; incident confirmed by the agency), Berlin state government (Germany; 2026; reported €2 million demand refused; stolen credentials published per news reporting), Leak-site listings tracked by this dashboard (2026): SAD'S Interim; Rug & Home
Estimated earnings
No public figure.
Leak-site victims288 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Axdia International | · 3d ago | Axdia International Axdia International is a German electronics company that brings together a wide range of modern small electronics and electric mobility products. More |
| General Santos Doctors Hospital | · 5d ago | General Santos Doctors Hospital 3.502.636 files, total volume ~2.44 TBPatient data (PHI) � name-tagged scans across department shares (surgical pathology, hemodialysis charts, admission records), cancer-center dossiers with PhilHealth IDs, lab quotations incl. cancer-marker tests with birth dates, PhilHealth claims monitoring, neonatal (NICU) dataStaff and professionals � accredited physicians register (cell numbers, PRC licenses, PhilHealth IDs), named payroll workbooks (incl. the affiliated diagnostic center), HR dossiers, staff passport scans, drug-test filesMoney, audit and governance � audited financial statements personally signed by chairman/treasurer/CFO with BIR stamps, balance sheet, all bank accounts across six-plus banks, internal-audit memos on (cashier discrepancies and cash shortages), SEC stockholders' minutes, payroll bank-upload batches, related-party entities on the same sharesLeadership personal data � personal cell numbers of the president, hospital administrator and board members More |
| Professional Retail Services | · 5d ago | Professional Retail Services Owner�s documents: employee evaluations, salary rates, bonuses, job offers, family documentsCFO�s documents: client credit reports, bankruptcy records, tax documents, father�s medical records (guardianship court case)Corporate financials: owner�s personal tax return, credit application, signed checks with MICR (BNB Bank)Corporate credit cards, drug testsMedical records, employee health insuranceAnd much more More |
| SAD'S Interim | · 7d ago | SAD'S Interim Since 2000, SAD'S INTERIM has established itself as a key player in the temporary employment sector.Bank statements (relev�s) with SEPA credit transfersFactoring: invoice import batches, client receivables ledgers (encours) with EUR amounts and named clients, payment receipts (quittances)SQL backups of the BRANIPP ERP (the temp-workers payroll database)Payslips (bulletins de salaire) and payroll validation workbooksPermanent-staff employment contracts signed by the owners (Sadoun family)Temp-worker contracts, Pole Emploi attestationsPassports (EU and third-country nationals)CARTE BTP (construction-worker cards with photo and DOB)carte Vitale (health-insurance cards)RIB (bank account details)NIR (national insurance numbers)MDPH (disability recognition documents) More |
| Rug & Home | · 8d ago | Rug & Home Rug & Home is a leading destination in the USA for rugs, furniture, and home decor, offering a vast selection of unique designs and top brands.Database of 50,193 customers�full names, home addresses, email addresses, phone numbers, purchase amounts (CSV)~10,800 scans�signed delivery notes with customer addresses/phone numbersPlaintext passwords for ~60 B2B supplier portalsW-2, 1099, W-9 � tax forms with employees' and contractors' SSNsPayroll database for all employees (Sage EMPLOYEE/ESWAGE)Company bank details (First Citizens Bank deposits) and employee accounts (direct deposit)HR: background checks, terminations, workplace injuries, 401(k)And much more More |
| Szechenyi Programiroda Nonprofit Kf | · 14d ago | Szechenyi Programiroda Nonprofit Kf As a key player in Hungarian development policy, our Company participates in the planning and implementation of development programs based on certain EU and domestic funds. More |
| Berlin, Germany | · 18d ago | Berlin, Germany Total capacity 5.79 TBArchive scale: ~1.44 million files scanned; by category � Maps/Geo 124,823, Legal/complaints 77,939, Financial 55,553, Contracts 46,522, HR 27,299,Government supervisory 13,142, Confidential 11,777, Infrastructure 8,110, Passwords 5,941, Health 2,738, Contacts 2,287.PII leak: 16,389 e-mails, 11,963 phone numbers, 12,076 individuals, 148 IBANs.Credentials in plaintext: Geb�udeAtlas, the ePayment PAYONE payment database, personal 'password safes' (danz, kramell � Z_ADMIN database accounts, franssen), leadership credentials.Disciplinary proceedings: the ANDERSON case (432 files, 2025�2026, lawsuit at VG Berlin administrative court), the politically motivated misconduct case involving the LKA Staatsschutz (state security police), the forestry cases BLAUTH/M�LLER/FIELICKE.State secrets: Bundesrat committee protocols with declassification correspondence, Geheimschutz (classified-material handling) data.Passports/IDs (recent, from personnel files and GI-Vertraulich).KRITIS: vulnerability analyses of Berlin's water supply.Mass personal data: Personalakten (personnel files) >5,000, Convotis payroll, OWi (administrative-offence) files >5,000, Postbuch SQL dumps 2020�2026, PST archives, leadership private data (IBANs, ID cards, Behrendt's bank card).NDA: 3,226 documentsLegal violation map (GDPR Art. 32/9/33, VSA/StGB upon VS classification confirmation, BSIG/KRITIS) More |
| Valley Health Team | · 18d ago | Valley Health Team 9,056,196 files3.28 TBLarge SQL databases containing the clinic's entire lifetime of information.Major databases:160,870 patients4.18 million diagnoses7.6 million unencrypted EHR scansSSN, passports, and other personal data.Financial statements, salaries, taxes.Dear customers, please submit your requests�there are plenty of files here that can be monetized. More |
| CRI Electric | · 24d ago | CRI Electric CRI Electric is a veteran-owned business based in San Antonio, providing professional electrical services since 1998. They cater to both residential and commercial clients, offering services such as emergency electrical repairs, EV charger installations, and home rewiring. We are pleased to present:Employee's federal account artifacts** (`HR-Confidential\Israel's Forms`): Login.gov personal recovery key (VA identity), TSP (retirement savings), ID.me, DoD DS Logon, PIEE (DoD contract payments)151 vendor W-9 forms** (SSN/EIN), payroll docs, HR-lawyer (privileged) correspondence, OSHA-adjacent injury/incident reports with photos.Public-sector bid pricing** (2025�2026: SAWS HQ EV charging, SAISD, NISD) � bid-competitiveness and Davis-Bacon certified-payroll context.Corporate docs (SDVOSB certification, Articles, bylaws, stock ledgers), QuickBooks financials, a Power of Attorney More |
| Fairview Dental Group | · 25d ago | Fairview Dental Group Fairview Dental Group offers a range of dental services including family dentistry, cosmetic treatments, dental implants, and invisible braces.We are pleased to present:Full patient database, patient X-rays, scanned forms/consents/invoices, health records (PHI) of the entire practice, unencrypted. More |
| Coming soon | · 25d ago | Coming soon Total capacity 5.79 TBLegal/Complaints/Offenses 77,939 OWi proceedings, lawsuits, legal opinionsFinance 55,553 Budget, invoices, ProFISKAL, debt collectionContracts 46,522 Contracts, NDAs, procurementHR/Personnel 27,299 Personnel files, payroll, performance reviewsOversight/Government 13,142 Inquiries from the House of Representatives, GWTVConfidential-Secret 11,777 GI-Confidential folders, security classificationInfrastructure/Critical Information Infrastructure 8,110 KRITIS, risk analysis, emergency plansPasswords/secrets 5,941 files containing login credentialsHealth/insurance 2,738 medical benefitsContacts/Addresses 2,287 address databases, phone listsExtracted from the content: 16,389 unique email addresses, 11,963 phone numbers, 12,076 individuals with names, 148 IBANs, 820+ monetary amounts (up to �30 million).And a wealth of other valuable data. More |
| Battle Creek Public Schools | · 25d ago | Battle Creek Public Schools Battle Creek Public Schools in Nebraska provides educational services for students from pre-kindergarten through 12th grade. We are pleased to present:Student records of named minors:** IEP/special-ed files, disability determination notices, discipline/suspension records.Federal funds compliance trail (ESSA/Title I application), staff health-spending claims (payflex/EHA) More |
| Pierce Township | · Aug 14, 2026 | Pierce Township Pierce Township is a growing community in Ohio that blends rural charm with suburban living, covering 23.5 square miles and home to over 16,000 residents.We are pleased to present:Judicial materials - Grand Jury subpoena response incl. hospital records (Mercy Hospital), public records requests, fire investigation reportsEmployee PII - Social Security numbers (SSA-1945, W-4, Ohio Tax forms), CDL licenses, health insurance waivers, new-hire packetsLegal settlements - Logan Creek v. Pierce Township, Purdue opioid settlement, easement and lease agreementsFinancial records - budgets, tax levies, appropriation reports, invoices, paymentsInternal email archives of township officials and administration More |
| SIA Medical Centre | · Aug 13, 2026 | SIA Medical Centre SIA Medical was established in 1993 and was founded by Dr Martin Sia in Melbourne's northwest. 9 clinics - Box Hill, Burwood, Croydon, Essendon, Footscray, Moonee Ponds, Montrose, Mulgrave and Berwick.We are pleased to present:~20,000 patient medical records - names, dates of birth, Medicare numbers, clinical notes, insurance and work-cover files, full patient dossiersStaff identity documents - passports, driver's licenses, police checks, tax file declarations of doctors and employeesPlaintext credentials - logins and passwords for clinical systems (Synapse imaging, PRODA, terminal server, doctor accounts)HR records - signed employment contracts, staff incident reports, immunisation registersLegal & financial - subpoenas, complaints, Bupa contracts, bank details (BSB/ABN), provider payment forms More |
| Lawson Roofing | · Jun 18, 2026 | Lawson Roofing Lawson Roofing is a fourth-generation company based in San Francisco, CA, specializing in high-quality roofing and waterproofing systems for both commercial and residential projects. More |
| IDS Group | · May 25, 2026 | IDS Group IDS Group is an award-winning multi-discipline design, engineering, and management consulting firm based in Southern California. More |
| Landeshauptstadt Stuttgart | · May 19, 2026 | Landeshauptstadt Stuttgart Stuttgart is the capital city of Baden-Wurttemberg in southwestern Germany. More |
| Tower View Primary School | · May 15, 2026 | Tower View Primary School Tower View Primary School is an educational institution that serves approximately 380 pupils across 14 classes. More |
| Stelia North America | · Apr 27, 2026 | Stelia North America STELIA North America is an aerospace and defence company specializing in the design, development, and manufacturing of composites.10 TB of confidential data!Data from major partner companies, such as: Lockheed Martin, Northrop Grumman, Sikorsky, Leonardo, L3Harris, Airbus Atlantic, Boeing, Bombardier, De Havilland, ARDE, MDA. More |
| Southold Town Senior ServicesSouthold Police Department | · Mar 2, 2026 | Southold Town Senior ServicesSouthold Police Department The Town of Southold, New York provides various government services including forms and permits, online payments, and notifications for residents. Southold Police Department is a company that operates in the Local industry. More |
| Rohner | · Feb 23, 2026 | Rohner Rohner designs and builds high-quality, custom paint booths and manufactured industrial paint systems. Our quality and service, cutting-edge technology, and engineering experience provide the best value in the finishing equipment industry. More |
| Cheyenne & Arapaho Tribes | · Feb 17, 2026 | Cheyenne & Arapaho Tribes The Cheyenne and Arapaho Tribes are a federally recognized united nation of two distinct peoples-the Tsistsistas (Cheyenne) and Hinono'ei (Arapaho)-with a historic alliance formed in the early 19th century. More |
| Phoenix Art Museum | · Feb 12, 2026 | Phoenix Art Museum Phoenix Art Museum is an art museum that showcases art from around the U.S. in Phoenix, Arizona. More |
| Leading Edge Speciali | · Feb 6, 2026 | Leading Edge Speciali |
| Lakeside Union School District | · Feb 4, 2026 | Lakeside Union School District The Lakeside Union School District in California serves preschool through 8th-grade students, focusing on a safe, nurturing environment that promotes academic success, personal growth, and responsible citizenship. More |
| Elabs | · Feb 2, 2026 | Elabs Elabs is a pioneer in IT services in Germany, delivering innovative IT solutions that enable businesses to harness modern technology for added value and transformation. More |
| MACT Health Board | · Jan 29, 2026 | MACT Health Board MACT Health Board, Inc. provides quality and comprehensive healthcare services to the counties of Mariposa, Amador, Calaveras, and Tuolumne in the United States. More |
| Cytek Biosciences | · Jan 25, 2026 | Cytek Biosciences Cytek Biosciences is a leading cell analysis solutions company founded in 1992 and headquartered in Fremont, California with global offices across North America, Europe, and Asia. Sold 0% All data was sold, stay with us, we will upload new Companies later More |
| Jet-care International | · Jan 21, 2026 | Jet-care International Jet-Care provides first-class laboratory services tailored for the Aviation, Industrial, and Marine sectors. More |
| Charles Leonard Steel Services | · Jan 6, 2026 | Charles Leonard Steel Services Charles Leonard Steel Services (CLSS) is a full-service miscellaneous metals fabricator and erector specializing in steel stairs, railings, structural steel, grating, decks, and ladders. More |
| Falk, Waas, Hernandez, Cortina, Solomon & Bonner Overview Metrics | · Dec 30, 2025 | Falk, Waas, Hernandez, Cortina, Solomon & Bonner Overview Metrics Falk Waas is a premier insurance defense law firm in Florida, boasting over 40 years of experience in providing exceptional legal representation. More |
| Larry Pitt & Associates | · Dec 19, 2025 | Larry Pitt & Associates Larry Pitt Associates is a law firm specializing in workers compensation, personal injury, and Social Security Disability claims in Pennsylvania. More |
| YOKOSUKA GAKUIN | · Dec 15, 2025 | YOKOSUKA GAKUIN Yokosuka Gakuin, a private school in Yokosuka, Kanagawa Prefecture, Japan. The school was established in 1950. More |
| ***** *********** | · Dec 13, 2025 | ***** *********** The company is one of the leaders in the production of equipment for scientific laboratory analysis of cells. The company's developments are used in innovative biotechnology research projects around the world, as well as in research into deadly diseases, in particular, oncological and infectious diseases. The data we provide contains detailed information about the following equipment and more: 1. A device that allows researchers to analyze individual cells or particles in a liquid, determining many of their characteristics simultaneously. 2. A compact laboratory device designed for rapid and automatic analysis of cells and particles in liquid samples. 3. A small tabletop laboratory device that allows quick and automatic measurement of the characteristics of cells and particles in liquid samples. 4. A compact laboratory device for multidimensional analysis of cells and particles, designed for quick and accurate measurement of multiple cell characteristics simultaneously 5. A desktop laboratory device designed to analyze cells and particles with high accuracy, allowing you to examine multiple characteristics of each cell simultaneously. 6. Reagents, software, and service support for working with the devices. 7. Patents for the technologies used, both their own and those of their contractors. Contents of the leak: - R&D materials, protocols, diagrams, equipment source code, firmware for sensors and various modules, - Technical documentation - drawings and 3D models of innovative equipment, - Production documents - instructions, test protocols, - Commercial information - strategies, prices, offers. More |
| United Keetoowah Band of Cherokee Indians in Oklahoma | · Dec 12, 2025 | United Keetoowah Band of Cherokee Indians in Oklahoma The Keetoowahs were the first Cherokees to move west, first voluntarily to avoid encroachment from colonizers, and then involuntarily to Indian Territory after the Indian Removal Act. Today we presently reside in the Cherokee capital of Tahlequah, Oklahoma. More |
| Woodard, Emhardt, Henry, Reeves & Wagner, LLP | · Dec 11, 2025 | Woodard, Emhardt, Henry, Reeves & Wagner, LLP Woodard, Emhardt, Henry, Reeves & Wagner, LLP is one of the nation's oldest full-service intellectual property law firms. Here you will find documents, patents, and learn about court cases involving the following companies: Sig Sauer Inc - Manufacturing (military) IOWA ARMY NATIONAL GUARD - military Baoshan Iron & Steel Co., Ltd. (aka 'Baosteel') - Steel production - carbon & specialty steel, flat & long products; supplies construction, automotive, shipbuilding, heavy-industry, industrial goods. BorgWarner Inc. - Automotive supplier - drivetrains, e-propulsion, thermal/air management, EV & combustion components Bosch Group - Global technology & engineering conglomerate - mobility, consumer goods, industrial tech, energy & building tech Biogen Inc. (formerly Biogen Idec) - Biotechnology / pharmaceuticals - treatments for neurological diseases (MS, SMA, etc.) Bristol-Myers Squibb Company (BMS) - Global biopharmaceutical firm - oncology, immunology, cardio, neuroscience, other therapies. AbbVie Inc. - Global biopharmaceutical / pharmaceutical company - immunology, oncology, neuroscience, aesthetics, other therapies. 3M Company - Diversified industrial & consumer-goods conglomerate - adhesives, safety / industrial products, consumer & office products, healthcare/industrial materials. GE Healthcare Bio-Sciences Corp. - Biopharmaceuticals, medical devices, life sciences Denka Company Limited - Chemicals, specialty products (synthetics, rubber chemicals, etc.) Duke Energy Indiana Incorporated - Electricity generation and distribution F. Hoffmann-La Roche AG - Pharmaceuticals, diagnostics BASF Aktiengesellschaft - Chemicals, materials, industrial solutions AstraZeneca Pharmaceuticals LP - Pharmaceuticals as well as many others. More |
| Harbour Town Doctors | · Dec 11, 2025 | Harbour Town Doctors Harbour Town Doctors is an accredited comprehensive general practice medical centre on the Gold Coast, Australia, offering general family medicine, chronic disease management, skin checks, women's/men's health, travel medicine and related medical services. More |
| Kane's Furniture | · Dec 7, 2025 | Kane's Furniture Kane's Furniture is a long-established home furnishings retailer founded in Florida in 1948. It is known for offering affordable, high-quality furniture in a wide range of styles, with a focus on value for money and customer service. More |
| SODISE | · Dec 6, 2025 | SODISE SODISE is a French wholesale distributor and manufacturer of professional tools and equipment for workshops of various brands, offering a wide range of products: from power tools, compressors, and welding equipment to lighting fixtures and loading and unloading equipment. More |
| Bo Beuckman Ford | · Dec 3, 2025 | Bo Beuckman Ford At Bo Beuckman Ford, we're a family-owned business that's been serving Ellisville and the greater St. Louis community for over five and a half decades. More |
| Cleveland County Sheriff's Office | · Dec 2, 2025 | Cleveland County Sheriff's Office The Cleveland County Sheriffs Office (CCSO) provides law enforcement services to the Cleveland County community, focusing on protecting citizens and serving with compassion. More |
| AGS | · Nov 26, 2025 | AGS Today, Accelerated Global Solutions (AGS) is a rapid-growing global company headquartered in New York, NY that manages a service network of freight stations and fulfillment operations providing coverage across major gateway cities in the United States, Canada & China. More |
| Marlex Human Capital | · Nov 25, 2025 | Marlex Human Capital Marlex Great People specializes in human resources, focusing on talent selection and evaluation for key positions within companies. More |
| Collge Superieur De Montreal | · Nov 24, 2025 | Collge Superieur De Montreal College Superieur de Montreal is a private institution recognized and subsidized by the government, specializing in vocational training in fields such as Accounting, Pharmacy Technical Assistance, and Medical or Legal Secretarial studies. More |
| St. Joseph's Healthcare Hamilton | · Nov 22, 2025 | St. Joseph's Healthcare Hamilton St. Joseph's Healthcare Hamilton (SJHH) is a research and academic health science centre located in Hamilton, Ontario. More |
| Wachusett School District MA | · Nov 21, 2025 | Wachusett School District MA Wachusett School District MA is a public school district. More |
| Smoll & Banning, CPAs | · Nov 18, 2025 | Smoll & Banning, CPAs Smoll & Banning, CPA's, LLC is an independent accounting firm located in Dodge City, Kansas. More |
| Heart South Cardiovascular Group | · Nov 10, 2025 | Heart South Cardiovascular Group Heart South is a leading provider of comprehensive cardiac and vascular care in Central Alabama. More |
| LMHT Associates | · Nov 10, 2025 | LMHT Associates LMHT Associates is an architecture and engineering design firm that provides comprehensive services from conceptualization to design and construction administration. More |
| KISS FM | · Nov 5, 2025 | KISS FM Spanish radio station KISS FM, which broadcasts popular music and entertainment programs. The radio is available online, as well as traditionally on radio waves in Spain. The station is owned by the Spanish media group Mediaset Espana. More |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .