rhysida
ransomware group · aka Rhysida, Rhysida ransomware, possible Vice Society overlap (suspected by some vendors, unconfirmed) · unknown; no confirmed attribution. Some vendor reporting (2023) suggested tooling or operational overlap with the Vice Society actor based on shared TTPs, but a direct link remains unconfirmed. · active since May 2023 (per vendor research)
Victims · 7d
3▲1 vs prev. week
Victims · 30d
12active targets
Victims · 90d
15
All-time (tracked)
288since 2023-06-09
Last post
09-12 15:39UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Rhysida is a ransomware and double-extortion group first publicly observed in May 2023, operating an affiliate-style model and publishing stolen data on a Tor leak site. It is known for high-profile attacks on public-sector and critical-service targets, including Prospect Medical Holdings, the British Library, and the Chilean Army (all 2023). Several researchers have suggested overlap with the Vice Society actor, citing shared tactics such as intermittent encryption, though this remains unconfirmed. Per this dashboard, the group's leak site posted 2 victims in the past 30 days, most recently on 2026-09-08, including publication of stolen Berlin state government login credentials after a reported €2 million extortion demand was refused (news reporting, 2026). No comprehensive public earnings estimate for the group has been identified.
Tactics & tooling
- Initial access via phishing emails with malicious links or attachments (vendor reporting, 2023)
- Use of legitimate remote monitoring/management and remote-access tools in intrusions
- Double extortion: data exfiltration followed by publication on a Tor leak site
- Public auctions of stolen victim data on cybercrime markets (reported 2023, e.g., Prospect Medical Holdings)
- C-based ransomware encryptor using ChaCha20 for file encryption with RSA-4096-protected keys (analyst analyses, 2023)
- Intermittent/partial encryption in some incidents, a technique also associated with the Vice Society actor
- Recruitment of affiliates via cybercrime forums (reported 2023)
- Targeting skewed toward healthcare, education, government, and cultural institutions, though activity is opportunistic
Targeted sectors
HealthcareEducation and cultural institutionsGovernment and public sectorPublic health agenciesMultiple verticals (opportunistic)
Notable public victims
Prospect Medical Holdings (US healthcare; 2023; breach and reported data auction covered by media/vendor reporting), British Library (UK; 2023; reported £600,000 (~$750,000) demand refused; data published), Chilean Army (2023), Southern Nevada Health District (US; 2023; incident confirmed by the agency), Berlin state government (Germany; 2026; reported €2 million demand refused; stolen credentials published per news reporting), Leak-site listings tracked by this dashboard (2026): SAD'S Interim; Rug & Home
Estimated earnings
No public figure.
Leak-site victims288 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| MarineMax | · Mar 21, 2024 | MarineMax The company retails recreational boats. MarineMax sales new and used boats, parts, and accessories, as well as offers repair services. More |
| Kolbe Striping | · Mar 20, 2024 | Kolbe Striping Kolbe Striping offers both durable and lasting pavement marking as well as temporary markings designed to suit your needs. More |
| Brooks Tropicals | · Mar 12, 2024 | Brooks Tropicals Brooks Tropicals grows its popular Caribbean Red papayas in several Caribbean locales. More |
| Ann & Robert H. Lurie Children's Hospital of Chicago | · Feb 27, 2024 | Ann & Robert H. Lurie Children's Hospital of Chicago Ann & Robert H. Lurie Children's Hospital of Chicago provides superior pediatric care in a setting that offers the latest benefits and innovations in medical technology, research and family-friendly design. More |
| Ironrock | · Feb 27, 2024 | Ironrock Ironrock is a manufacturer of high quality indoor/outdoor unglazed ceramic quarry tile, and architectural thin brick. More |
| ASP BasilicataASM MateraIRCCS CROB | · Feb 15, 2024 | ASP BasilicataASM MateraIRCCS CROB www.asmbasilicata.itwww.aspbasilicata.itwww.crob.it More |
| CNPC Peru S.A. | · Feb 1, 2024 | CNPC Peru S.A. CNPC Peru S.A., formerly known as Petrobras Energia Peru S.A., operates in the country since 1993. More |
| Lee Spring | · Jan 13, 2024 | Lee Spring Lee Spring manufactures and distributes mechanical springs, wire forms, stampings and fourslide parts worldwide. More |
| The Lutheran World Federation | · Jan 6, 2024 | The Lutheran World Federation We are a global communion of churches in the Lutheran tradition, living and working together for a just, peaceful, and reconciled world. More |
| Aspiration Training | · Jan 1, 2024 | Aspiration Training Aspiration Training is an award-winning specialist training provider, delivering qualifications in Dental, Adult Care and Early Years for over 20 years. More |
| Tshwane University of Technology | · Dec 26, 2023 | Tshwane University of Technology Tshwane University of Technology is a higher education institution in South Africa that came into being through a merger of three technikons - Technikon Northern Gauteng, Technikon North-West and Technikon Pretoria. More |
| Abdali Hospital | · Dec 26, 2023 | Abdali Hospital Abdali Hospital is a 200-bed multi-specialty hospital with the mission to provide best practice patient-centred care and promote research and education. More |
| Kauno Technologijos Universitetas | · Dec 19, 2023 | Kauno Technologijos Universitetas KTU offers 5 study programmes in computer sciences. More |
| Grupo Jose Alves | · Dec 12, 2023 | Grupo Jose Alves Founded in 1987, the company has a production center in the municipality of Trindade-GO, with nine distribution centers in the cities of Palmas, Gurupi, Itumbiara, Uruacu, Anapolis, Dianopolis, Rialma, Porangatu, Morrinhos and three Crossdocking centers in the cities of Sao Luis de Montes Belos, Rio Verde and Aparecida de Goiania. It directly serves 228 cities and more than 32,000 points of sale. More |
| Insomniac Games | · Dec 12, 2023 | Insomniac Games Insomniac Games, Inc. is an American video game developer based in Burbank, California. More |
| Holding Slovenske elektarne | · Dec 10, 2023 | Holding Slovenske elektarne Strategic enterprise of Slovenia's energy infrastructure. Contains confidential country data, schemes and plans of energy enterprises. Financial data and reports. Compromising content!!! More |
| Hse | · Dec 10, 2023 | Hse Strategic enterprise of Slovenia's energy infrastructure. Contains confidential country data, schemes and plans of energy enterprises. Financial data and reports. Compromising content!!! More |
| Qatar Racing and Equestrian Club | · Dec 9, 2023 | Qatar Racing and Equestrian Club Established in 1975 Qatar Racing and Equestrian Club is mandated with representing, promoting and advancing equine and equestrian initiatives from grassroots programs to the international arena. More |
| Tcman | · Dec 8, 2023 | Tcman Tcman was born with the vocation to provide real solutions to the need to improve the management of industrial assets. Documents Data Catalog: 108 GB, 179 Files 100% All files was uploaded to public access, data hunters, enjoy More |
| Travian Games | · Dec 8, 2023 | Travian Games Travian Games is one of the world's leading PC games companies, based in Munich. Documents (part 1) Documents (part 2) Data Catalog: 560 GB, 790 567 Files 50% Not sold data was uploaded, data hunters, enjoy More |
| King Edward VII's Hospital | · Nov 29, 2023 | King Edward VII's Hospital Unique files are presented to your attention! Data from the Royal Family! A large amount of patient and employee data. Sale in one lot!!King Edward VII's Hospital is an independent charitable hospital with a proud history of Royal Patronage, discreetly located within London's Harley Street medical district. More |
| Bangkok University | · Nov 28, 2023 | Bangkok University Bangkok University has operated since 1962, is one of the oldest and largest private, non-profit universities in Thailand. More |
| NC Central University | · Nov 27, 2023 | NC Central University North Carolina Central University (NCCU), a distinguished institution nestled in the heart of Durham, North Carolina, has earned national acclaim for its unwavering commitment to academic excellence, groundbreaking research opportunities and remarkable achievements in securing grants for innovative projects. More |
| Energy China | · Nov 24, 2023 | Energy China China Energy Engineering Corporation or Energy China, is a Chinese state-owned energy conglomerate, with headquarters in Chaoyang District, Beijing. More |
| St Edmund's College & Prep School | · Nov 21, 2023 | St Edmund's College & Prep School Located in 400 acres of beautiful Hertfordshire countryside, St Edmund's College and Prep School is a safe, stimulating environment for students aged 3-18, with boarding available from age 11. More |
| British Library | · Nov 20, 2023 | British Library The British Library is a research library in London that is the national library of the United Kingdom. It is one of the largest libraries in the worl. More |
| MHM Health | · Nov 11, 2023 | MHM Health MHM Health is dedicated to help our partner Independent Physician Associations remain independent as the healthcare industry transitions to value-based care. Documents Data Catalog: 294 GB, 593 521 Files 70% Not sold data was uploaded, data hunters, enjoy More |
| Azienda Ospedaliera Universitaria Integrata di Verona | · Nov 10, 2023 | Azienda Ospedaliera Universitaria Integrata di Verona The Verona Integrated University Hospital Company is a hospital facility that is part of the Veneto Health Service, based in the city of Verona and is one of the largest hospitals in Italy. More |
| Indah Water Konsortium | · Nov 7, 2023 | Indah Water Konsortium Indah Water Konsortium, a company owned by Minister of Finance Incorporated, is Malaysia's national sewerage company which has been entrusted with the tasks of developing and maintaining a modern and efficient sewerage system for all Malaysians. Documents Data Catalog: 448 GB, 330 772 Files 50% Not sold data was uploaded, data hunters, enjoy More |
| Mount St. Mary's Seminary | · Nov 6, 2023 | Mount St. Mary's Seminary Mount St. Mary's Seminary is the oldest division of the Athenaeum. The seminary has as its mission the preparation of candidates for the Catholic priesthood�a gift of God and the fruit of an integrated approach to formation. More |
| SMH Group | · Nov 5, 2023 | SMH Group In 2022, the SMH Group was born, with all the individual offices having their original names prefixed with 'SMH'. Documents (part 1) Documents (part 2) Documents (part 3) Documents (part 4) Documents (part 5) Documents (part 6) Documents (part 7) Documents (part 8) Documents (part 9) Data Catalog: 2 TB, 4 759 364 Files 80% Not sold data was uploaded, data hunters, enjoy More |
| GO! Handelsschool Aalst | · Nov 2, 2023 | GO! Handelsschool Aalst GO! Handelsschool Aalst is een milieubewuste school in het centrum van Aalst en streeft naar hoogstaand onderwijs op maat in een open sfeer. Documents Data Catalog: 114 GB, 218 811 Files 30% Not sold data was uploaded, data hunters, enjoy More |
| Northwest Eye Care Professionals | · Oct 14, 2023 | Northwest Eye Care Professionals Serving Clackamas and the surrounding communities in Vancouver and Beaverton, we offer comprehensive eye health services for all members of your family as well as specialty services. More |
| Southern Arkansas University | · Oct 9, 2023 | Southern Arkansas University Southern Arkansas University offers personalized tour visits, faculty and staff who invest in student success, and a caring campus community. More |
| Camara Municipal de Gondomar | · Oct 6, 2023 | Camara Municipal de Gondomar Discover Gondomar, a land of historical echoes, where the long history of generations attests to the identity of this Municipality. More |
| General Directorate of Migration of the Dominican Republic | · Oct 4, 2023 | General Directorate of Migration of the Dominican Republic The General Directorate of Migration of the Dominican Republic, is the governmental body called to exercise the legal safeguard of the sovereignty of territory through immigration control. More |
| Federal University of Mato Grosso do Sul | · Oct 2, 2023 | Federal University of Mato Grosso do Sul The Federal University of Mato Grosso do Sul, is a public university located in the state of Mato Grosso do Sul in Brazil. More |
| Istituto Prosperius | · Sep 26, 2023 | Istituto Prosperius Villa Cherubini reopens with a new facility within the Prosperius Institute health complex, established founded by Prof. Mario Bigazzi back in 1973. More |
| Ministry Of Finance (Kuwait) | · Sep 25, 2023 | Ministry Of Finance (Kuwait) Ministry of Finance is one of the governmental bodies of Kuwait and part of the cabinet. More |
| Ort Harmelin College of Engineering | · Sep 23, 2023 | Ort Harmelin College of Engineering Ort Harmelin College of Engineering is an innovative technological college located in the heart of the hi-tech area, Sapir in Netanya. More |
| Holon Institute of Technology | · Sep 22, 2023 | Holon Institute of Technology HIT Holon Institute of Technology, is a well-established unique and multidisciplinary academic institution, which manages to maintain its young spirit as well as its dynamic and contemporary nature. More |
| Singing River Health System | · Sep 10, 2023 | Singing River Health System Singing River Health System is both a mission-driven provider of health services and one of the largest employers on the Mississippi Gulf Coast. More |
| Core Desktop | · Sep 10, 2023 | Core Desktop Core Desktop is a Microsoft Tier 1 CSP Partner delivering key IT managed solutions that merge legacy technology with innovative cloud solutions. More |
| IT-Center Syd | · Sep 9, 2023 | IT-Center Syd IT Center South is an operations center for an administrative IT service community consisting of several state-owned educational institutions spread over 11 land registers around the region of Southern Denmark. More |
| Prince George's County Public Schools | · Aug 25, 2023 | Prince George's County Public Schools Prince George's County Public Schools (PGCPS), one of the nation's 20th largest school districts, has 201 schools and centers, more than 133,000 students and nearly 20,000 employees. More |
| Prospect Medical Holdings | · Aug 24, 2023 | Prospect Medical Holdings BIG sale!!! Introducing our new partners - Prospect Medical Holdings. They kindly provided: more than 500000 SNNs, passports of their clients and employees, driver's licenses, patient files (profile, medical history), financial and legal documents!!! If you are interested in our partner's confidential documents, you will be able to purchase them too!!! Total 1TB unique files, as well as 1.3TB SQL database. More |
| Pierce College | · Aug 22, 2023 | Pierce College Pierce College creates quality educational opportunities for a diverse community of learners to thrive in an evolving world. More |
| Municipality of Ferrara | · Aug 16, 2023 | Municipality of Ferrara Ferrara is a city and comune in Emilia-Romagna, northern Italy, capital city of the Province of Ferrara. More |
| National Institute of Social Services for Retirees and Pensioners | · Aug 12, 2023 | National Institute of Social Services for Retirees and Pensioners The National Institute of Social Services for Retirees and Pensioners is the largest social work in Latin America. More |
| Optimum Health Solutions | · Aug 9, 2023 | Optimum Health Solutions Optimum Health Solutions is Australia's leading preventative health company. More |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .