rhysida
ransomware group · aka Rhysida, Rhysida ransomware, possible Vice Society overlap (suspected by some vendors, unconfirmed) · unknown; no confirmed attribution. Some vendor reporting (2023) suggested tooling or operational overlap with the Vice Society actor based on shared TTPs, but a direct link remains unconfirmed. · active since May 2023 (per vendor research)
Victims · 7d
3▲1 vs prev. week
Victims · 30d
12active targets
Victims · 90d
15
All-time (tracked)
288since 2023-06-09
Last post
09-12 15:39UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Rhysida is a ransomware and double-extortion group first publicly observed in May 2023, operating an affiliate-style model and publishing stolen data on a Tor leak site. It is known for high-profile attacks on public-sector and critical-service targets, including Prospect Medical Holdings, the British Library, and the Chilean Army (all 2023). Several researchers have suggested overlap with the Vice Society actor, citing shared tactics such as intermittent encryption, though this remains unconfirmed. Per this dashboard, the group's leak site posted 2 victims in the past 30 days, most recently on 2026-09-08, including publication of stolen Berlin state government login credentials after a reported €2 million extortion demand was refused (news reporting, 2026). No comprehensive public earnings estimate for the group has been identified.
Tactics & tooling
- Initial access via phishing emails with malicious links or attachments (vendor reporting, 2023)
- Use of legitimate remote monitoring/management and remote-access tools in intrusions
- Double extortion: data exfiltration followed by publication on a Tor leak site
- Public auctions of stolen victim data on cybercrime markets (reported 2023, e.g., Prospect Medical Holdings)
- C-based ransomware encryptor using ChaCha20 for file encryption with RSA-4096-protected keys (analyst analyses, 2023)
- Intermittent/partial encryption in some incidents, a technique also associated with the Vice Society actor
- Recruitment of affiliates via cybercrime forums (reported 2023)
- Targeting skewed toward healthcare, education, government, and cultural institutions, though activity is opportunistic
Targeted sectors
HealthcareEducation and cultural institutionsGovernment and public sectorPublic health agenciesMultiple verticals (opportunistic)
Notable public victims
Prospect Medical Holdings (US healthcare; 2023; breach and reported data auction covered by media/vendor reporting), British Library (UK; 2023; reported £600,000 (~$750,000) demand refused; data published), Chilean Army (2023), Southern Nevada Health District (US; 2023; incident confirmed by the agency), Berlin state government (Germany; 2026; reported €2 million demand refused; stolen credentials published per news reporting), Leak-site listings tracked by this dashboard (2026): SAD'S Interim; Rug & Home
Estimated earnings
No public figure.
Leak-site victims288 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Stratford School Academy | · Sep 8, 2024 | Stratford School Academy We are a mixed, all ability, and non-faith school. Our purpose is to educate all the children in our diverse local community. More |
| Project Hospitality | · Sep 2, 2024 | Project Hospitality We are an interfaith effort, committed to serving the needs of hungry and homeless people. More |
| White Mountain Backpacks | · Aug 31, 2024 | White Mountain Backpacks White Mountain Backpacks has been responsible for innovative design in performance backpacks for more than 30 years. More |
| Sports & Spine Orthopaedics | · Aug 31, 2024 | Sports & Spine Orthopaedics The orthopedic surgeons and doctors of Sports & Spine are specialized in a range of conditions, and our team is here to provide you with a solution that best fits your needs. More |
| Corbally Gartland and Rappleyea | · Aug 29, 2024 | Corbally Gartland and Rappleyea Corbally, Gartland and Rappleyea, LLP is a full-service law firm based in Pleasant Valley and Millbrook, New York. We provide aggressive, ethical, cost-effective legal counsel and advocacy to people and businesses. More |
| NewsBank | · Aug 26, 2024 | NewsBank NewsBank, inc. has been a premiere provider of the world's largest repository of reliable information for more than 50 years. More |
| Affordable Tools | · Aug 25, 2024 | Affordable Tools Our mission is to provide a positive buying experience offering low prices, fast shipping, and friendly customer service. More |
| Kronick Moskovitz Tiedemann & Girard | · Aug 22, 2024 | Kronick Moskovitz Tiedemann & Girard Kronick Moskovitz Tiedemann & Girard was established in 1959 with a focus on water and water-related resource law. More |
| Engedi | · Aug 22, 2024 | Engedi Engedi is a community based, local Mackay organisation providing support to people with a disability. More |
| Olympus Financial | · Aug 21, 2024 | Olympus Financial Olympus Financial is here to provide a smoother, faster, and more efficient mortgage journey. More |
| Waynesboro Nurseries | · Aug 19, 2024 | Waynesboro Nurseries Waynesboro Nurseries is a major wholesale supplier for the Eastern United States with customers from Maine to Georgia. More |
| Sterling Rope | · Aug 16, 2024 | Sterling Rope Founded in 1992, Sterling Rope Company has established itself as a leader in designing, developing and manufacturing high-performance ropes and life-safety products. More |
| Liberty Resources | · Aug 15, 2024 | Liberty Resources Liberty Resources, Inc., headquartered in Syracuse, New York, is one of Central New Yorks most diversified and trusted human service agencies. More |
| The Washington Times | · Aug 14, 2024 | The Washington Times The Washington Times is an American conservative daily newspaper published in Washington, D.C. It covers general interest topics with an emphasis on national politics. More |
| The White Center Community Development Association | · Aug 13, 2024 | The White Center Community Development Association The White Center CDA is a vibrant, evolving community organization guided by the White Center Neighborhood Action Plan and engaged in various core programs and partnership initiatives to benefit the White Center community. More |
| Moser Wealth Advisors | · Aug 11, 2024 | Moser Wealth Advisors Based in Bellevue, Washington, Moser Wealth Advisors is a regionally owned and operated wealth management firm that combines a Certified Public Accounting firm and Registered Investment Advisor to deliver comprehensive financial planning solutions that incorporate sophisticated tax and investment advice to high net worth individuals, families and business owners. More |
| Sumter County Sheriff | · Aug 9, 2024 | Sumter County Sheriff The Sumter County Sheriff's Office is founded on the principles of integrity, respect, honesty, and caring for others. More |
| Bayhealth Hospital | · Aug 7, 2024 | Bayhealth Hospital Bayhealth is a technologically advanced not-for-profit healthcare system with nearly 4,000 employees and a medical staff of more than 450 physicians and 200 advanced practice clinicians. More |
| Maryville Academy | · Aug 5, 2024 | Maryville Academy Maryville is a child care organization rooted in Catholic social teaching and dedicated to the preservation of the dignity of children at every age. More |
| Ranney School | · Aug 4, 2024 | Ranney School Ranney School is unique in our area. We are the only Age 3 through Grade 12 independent, co-ed, secular college preparatory school in Monmouth County, NJ. More |
| City of Columbus, Ohio | · Jul 31, 2024 | City of Columbus, Ohio Columbus is an American city, the state capital of, and the largest city in the state of Ohio. It is the 15th largest city in the United States. Participating in the auction, you have the opportunity to buy more than 6.5TB of databases, internal logins and passwords of employees, a full dump of servers with emergency services applications of the city, access from city video cameras. When buying, you also get full instructions and support, certificates for databases. More |
| New Jersey City University | · Jul 27, 2024 | New Jersey City University Established in 1927 as a training school for teachers, today New Jersey City University is among the most comprehensive universities in the state. More |
| Computer Networking Solutions | · Jul 27, 2024 | Computer Networking Solutions Computer Networking Solutions, dba LightSpeed DataLinks (LDL) is a small business located in Columbus, Georgia. LDL has been in business since 1998 and is an active Cisco reseller. More |
| Community Care Alliance | · Jul 26, 2024 | Community Care Alliance Community Care Alliance is a unified human service agency integrating resources, supports and programs to strengthen families. More |
| LawDepot | · Jul 23, 2024 | LawDepot They told you everything was safe. We present to your attention the data of LowDepot. The total amount of data more than 5.5TB, includes backup of the SQL database, a full dump of the websites (www.lawdepot.com, www.lawdepot.co.uk, www.documentslegaux.fr, www.rechtsdokumente.de, www.legalcontracts.com, www.lawdepot.ca), internal passwords, certificates for databases. Confidential customer information (credit cards, PayPal data, customer legal documents) of several countries, internal Lowdepot-wiki knowledge base, full company internal Gitlab. By participating in the auction, you have the opportunity to open your online business with 0, having everything you need. The cost includes instructions, assistance in setting up databases. Updates: Added screenshots for a few new files More Download File Tree |
| Queens County Public Administrator | · Jul 20, 2024 | Queens County Public Administrator There is a Public Administrator in every county in the City of New York. More |
| Law Offices of the Public Defender - New Mexico | · Jul 19, 2024 | Law Offices of the Public Defender - New Mexico As the state's largest law firm, we represent low-income people facing criminal charges in New Mexico. More |
| Gandara Center | · Jul 17, 2024 | Gandara Center Gandara Center was founded in Springfield in 1977 to advocate and provide for equal and culturally competent services in behavioral health for the Hispanic community. More |
| Goede, DeBoest & Cross, PLLC. | · Jul 15, 2024 | Goede, DeBoest & Cross, PLLC. Since its founding, the firm has grown to a mid-size law firm where the partners have a genuine camaraderie and a dynamic and young vibe amongst its staff. There is a team mentality, a family atmosphere and a shared desire to help clients. More |
| BrownWinick | · Jul 14, 2024 | BrownWinick 1951, a tax-law specialty firm opened its doors in downtown Des Moines, Iowa. Its modest size hid lofty ambitions: to help its clients build on a strong foundation, and to put businesses from Iowa, the Midwest and around the country on a powerful footing for growth and competitive success. More |
| MYC Media | · Jul 7, 2024 | MYC Media MYC Media is your national creative agency providing full-service marketing to businesses looking to expand their brand�s reach and make an impact. More |
| DRM Resources | · Jun 29, 2024 | DRM Resources DRM Resources exists to create synergistic teams that unify diverse skill sets to envision new concepts and execute on them. More |
| Erivan Gecom Inc | · Jun 22, 2024 | Erivan Gecom Inc Founded in 1981 by Pierre Lajeunesse, the company was first known under the sole name of Erivan. At that time, the company was working in civil engineering and construction of large-scale concrete jobs. More |
| Production Machine & Enterprises | · Jun 16, 2024 | Production Machine & Enterprises Since 1978, Production Machine & Enterprises (PM&E) has specialized in the CNC machining of parts from non-ferrous castings to bar stock. Sold 0% All data was sold, stay with us, we will upload new Companies later More |
| CETOS Services | · Jun 16, 2024 | CETOS Services CETOS Services AG is an integrated IT service provider specializing in software packaging, software distribution and IT support. Sold 0% All data was sold, stay with us, we will upload new Companies later More |
| Kiemle-Hankins | · Jun 15, 2024 | Kiemle-Hankins Kiemle-Hankins and Birclar have been leaders in industrial maintenance for over 80 years, and together, we are one of the most trusted companies in the industry. More |
| California Rice Exchange | · Jun 8, 2024 | California Rice Exchange California Rice is The Environmental Crop. Nearly 230 wildlife species rely on Sacramento rice fields for food and a restimg place. More |
| Rob's Whole Health Pharmacy | · May 30, 2024 | Rob's Whole Health Pharmacy Rob's Whole Health Pharmacy opened in February of 2017. More |
| ICC | · May 23, 2024 | ICC ICC is a structured cabling solutions manufacturer of copper & fiber optic connectivity products for commercial & residential applications More |
| Widdop & Co. | · May 18, 2024 | Widdop & Co. Widdop Data System Program and SQL Databases for Sale!!!Widdop & Co, a family-owned wholesale gifts and home decor supplier, is selling the source code of their Widdop Data System program and relevant SQL databases for April 29, 2024. These databases contain all suppliers and buyers with contact details, the company's financial flows, and algorithms for discounts and margins. By buying these databases and software, you are buying a turnkey ready-made business. More |
| Surrey Place Healthcare & Rehabilitation | · May 15, 2024 | Surrey Place Healthcare & Rehabilitation Surrey Place Healthcare & Rehabilitation is a 74-bed Skilled Nursing facility in Bradenton, Florida. More |
| Unimed Vales do Taquari e Rio Pardo | · May 8, 2024 | Unimed Vales do Taquari e Rio Pardo We are the largest healthcare cooperative in the world. More |
| Lopez Hnos | · May 1, 2024 | Lopez Hnos Lopez Hnos is a leading company dedicated to offer a wide range of products in three business units: bicycles, bike parts and motorcycle parts with distribution throughout Argentina. More |
| CDSHotels | · Apr 25, 2024 | CDSHotels For thirty years our friendly staff, professionalism and attention to detail make CDSHotels a leader in the hospitality world. More |
| Ministerio de Desarrollo Local | · Apr 23, 2024 | Ministerio de Desarrollo Local The Ministry of Local Development is the government entity in charge of bringing investment and infrastructure works to the country's municipalities. More |
| Hernando County | · Apr 12, 2024 | Hernando County Hernando County was established in 1843 and named in honor of Spanish explorer Hernando de Soto. Updates: Added screenshots for a few new files More Download File Tree |
| Oki Golf | · Apr 11, 2024 | Oki Golf Oki Golf is a collection of 11 Seattle area golf courses, including The Golf Club at Newcastle, providing championship golf course layouts and outstanding course conditions to players of all skill levels. More |
| Malaysian Industrial Development Finance | · Apr 7, 2024 | Malaysian Industrial Development Finance MIDF, established in 1960 and based in Kuala Lumpur, is a financial development institution to modernize Malaysia's manufacturing industries. More |
| Seven Seas Technology | · Apr 3, 2024 | Seven Seas Technology Seven Seas Technology has chosen a collaborative, multi-cloud strategy that puts customers first by partnering with most of the major technology vendors. We help our customers innovate their processes, create valuable connections and rapport with their business and increase their productivity. More |
| El Debate | · Mar 27, 2024 | El Debate El Debate is a Mexican newspaper published by El Debate S.A. de C.V. of Culiacan, Sinaloa. More |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .