rhysida
Known ransomware group ACTIVE Currently active
Rhysida is a ransomware-as-a-service group active since 2023, repeatedly targeting healthcare, education, and government entities. It has been the subject of CISA advisories and is known for auctioning stolen data on its leak site.
8
Total Claims
3
Critical
—
Records Claimed
5
Industries Hit
Active span: May 15, 2026 – Nov 7, 2026 · 8 organizations targeted
Currently active
Actor Threat Profile
Activity Timeline
Peak: Oct 2026 (3)May 2026
LessMore
Nov 2026Share this profile
Top Targeted Industries
Education 3
Financial Services 2
Government & Defense 1
Healthcare 1
Professional Services 1
Tradecraft & Infrastructure
0
Documented tools
12 / 32
MITRE tactics / techniques
7
Known leak sites
Targeted Organizations
Claims by rhysida
Low
Ransomware Claim: Tribunal de Justica do Estado de Minas Gerais
Tribunal de Justica do Estado de Minas Gerais
rhysida
Ransomware Government & Defense
Nov 7, 2026 Critical
784 GB leaked Ransomware Claim: Here at Pope and Johnson County Title Company
Here at Pope and Johnson County Title Company
rhysida
Ransomware Financial Services
Nov 3, 2026 High
445.1 GB leaked Ransomware Claim: Phoenix Charter Academy
Phoenix Charter Academy
rhysida
Ransomware Education
Oct 31, 2026 Low
Ransomware Claim: INTI International University & Colleges
INTI International University & Colleges
rhysida
Ransomware Education
Oct 30, 2026 Critical
1.3 TB leaked Ransomware Claim: INTAX, Inc.
INTAX, Inc.
rhysida
Ransomware Financial Services
Oct 29, 2026 Critical
2.4 TB leaked Ransomware Claim: General Santos Doctors Hospital
General Santos Doctors Hospital
rhysida
Ransomware Healthcare
Sep 11, 2026 Low
Ransomware Claim: SAD'S Interim
SAD'S Interim
rhysida
Ransomware Professional Services
Sep 11, 2026 Low
Ransomware Claim: Tower View Primary School
Tower View Primary School
rhysida
Ransomware Education
May 16, 2026