rhysida
Known ransomware group ACTIVE Currently active
Rhysida is a ransomware-as-a-service group active since 2023, repeatedly targeting healthcare, education, and government entities. It has been the subject of CISA advisories and is known for auctioning stolen data on its leak site.
3
Total Claims
1
Critical
—
Records Claimed
3
Industries Hit
Active span: May 15, 2026 – Sep 10, 2026 · 3 organizations targeted
Currently active
Actor Threat Profile
Activity Timeline
Peak: Sep 2026 (2)May 2026
LessMore
Sep 2026Share this profile
Top Targeted Industries
Healthcare 1
Professional Services 1
Education 1
Tradecraft & Infrastructure
0
Documented tools
12 / 32
MITRE tactics / techniques
2
Known leak sites
Targeted Organizations
Claims by rhysida
Critical
2.4 TB leaked Ransomware Claim: General Santos Doctors Hospital
General Santos Doctors Hospital
rhysida
Ransomware Healthcare
Sep 11, 2026 Low
Ransomware Claim: SAD'S Interim
SAD'S Interim
rhysida
Ransomware Professional Services
Sep 11, 2026 Low
Ransomware Claim: Tower View Primary School
Tower View Primary School
rhysida
Ransomware Education
May 16, 2026