Rhysida

☆ pin

Reports

First seen

Oct 8, 2024

Last seen

Oct 16, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Professional Services ×10 Government ×9 Healthcare ×5 Manufacturing ×3 Other ×2 Education ×2 Retail & E-commerce ×2 Technology ×2

Victim regions

×1

×13

United States×13

Germany×9

Latvia×1

Hungary×1

France×1

Philippines×1

Colombia×1

Italy×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×9T1005 Data from Local System ×7T1566 Phishing ×7T1041 Exfiltration Over C2 Channel ×6T1078 Valid Accounts ×4T1190 Exploit Public-Facing Application ×3T1219 Remote Access Software ×3T1204 User Execution ×2T1195 Supply Chain Compromise ×2T1566.002 Phishing: Spearphishing Link ×2T1068 Exploitation for Privilege Escalation ×2T1567 Exfiltration Over Web Service ×2

Indicators

domain ×35cve ×21filename ×5

Indicator values are available on Pro and via the API.

Recent reports

High

Rhysida

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Anne Arundel County confirms August data breach after Rhysida ransomware claims

Rhysida ransomware gang publishes Reed & Giordano PA as new victim

Rhysida publishes Charles E. Tabor AAL LLC data breach

Rhysida ransomware gang publishes Gress Clark Young & Schoepper law firm data

Rhysida publishes Anne Arundel County as ransomware victim

Rhysida publishes RealManage breach: HOA financial records, tax data, and homeowner PII

Rhysida ransomware gang publishes Skaff Group breach

Rhysida ransomware publishes Mat Bao Corporation data

Rhysida publishes Electro Heat Sweden AB as ransomware victim

Cyber Brief 26-10 – September 2026

Rhysida publishes clicks digital GmbH as ransomware victim

Rhysida ransomware gang publishes Law Offices of R. David Williams, P.A.

Rhysida ransomware gang publishes NEAD Pro (Italian professional services firm)

Rhysida ransomware group claims breach of Legis, Latin American legal publisher

Rhysida publishes Kreishandwerkerschaft Borken as ransomware victim

Rhysida ransomware gang publishes MPA Pharma data

Rhysida publishes Axdia International as ransomware victim

Rhysida ransomware gang publishes General Santos Doctors Hospital data

Rhysida claims Professional Retail Services victim on ransomware.live

Rhysida ransomware gang publishes SAD'S Interim as victim

Rhysida ransomware publishes Rug & Home breach with customer and employee data

Berlin investigates data leak after hackers publish stolen login credentials

Rhysida publishes Szechenyi Programiroda Nonprofit Kf as ransomware victim

Berlin refuses ransom after Rhysida ransomware group steals 5.79TB of government data

Berlin confirms data theft after Rhysida ransomware attack claims

Berlin Refuses Ransom Demand After Rhysida Ransomware Attack Exfiltrates 5.79 TB

Rhysida publishes Valley Health Team as ransomware victim

Rhysida publishes Berlin, Germany as ransomware victim

Rhysida claims breach of CRI Electric, San Antonio electrical services firm

Rhysida publishes Fairview Dental Group as ransomware victim