INTAX Ransomware Claim by Rhysida (Oct 2026)

Claim Summary

The Rhysida ransomware group has allegedly listed INTAX, Inc., a property-tax compliance and bill-pay firm based in Lexington, Kentucky, on its dark web leak site. According to the threat actor, the claimed exfiltration occurred on or around October 29, 2026, and purportedly involves approximately 1.27 TB of data across 892,867 files.

INTAX, Inc. operates in the financial services sector, providing property-tax compliance and payment services to corporate clients. The group claims the affected data includes client tax returns, accounting records, identity documents, and internal communications.

This report is based solely on the threat actor’s public claim. Yazoul Security has not independently verified the breach, the data volume, or the contents described. Organizations named as purported clients should treat this information as unconfirmed.

Threat Actor Profile

rhysida is a ransomware operation that first emerged publicly in mid-2023. The group is widely assessed by security researchers to operate as a ransomware-as-a-service (RaaS) model, and it has been linked in public reporting to activity associated with Vice Society, though attribution remains debated among analysts.

Rhysida is known for double extortion - encrypting victim systems while allegedly exfiltrating data and threatening publication. The group has historically targeted healthcare, education, government, and manufacturing sectors, and has been observed auctioning stolen data on its leak site rather than only demanding a single ransom.

Publicly reported tools and tactics associated with Rhysida include use of Cobalt Strike, PowerShell for lateral movement and payload delivery, remote monitoring and management (RMM) tooling, and exploitation of exposed VPN and remote access services. The group has also been observed using living-off-the-land binaries (LOLBins) and disabling security controls prior to encryption.

Note: The intelligence feed accompanying this claim lists no confirmed tooling or victim count for this specific incident. The above reflects general public reporting on the group and should be treated as contextual, not incident-specific. No public YARA rules or detection signatures specific to this claim were provided; defenders should rely on broader Rhysida detection guidance from established threat intelligence vendors.

Alleged Data Exposure

According to the threat actor, the purported dataset includes:

• Client tax returns (the group claims 649,905 PDFs)
• Accounting records, including QuickBooks company files
• Financial documents such as bank account and routing numbers, wire forms, and W-9s
• Identity documents, including passports, driver licenses, and W-2s with SSNs
• Password files for government tax portals and internal systems
• Email archives and internal records

The group further claims that roughly 100 client organizations are represented in the data, naming several large brands. Yazoul Security has not confirmed any of these claims, the file counts, or the involvement of any named client. Ransomware groups frequently inflate scope and data sensitivity to increase pressure on victims.

Potential Impact

If the claim is accurate, the exposure of tax returns, SSNs, financial account details, and identity documents would represent a serious data breach with regulatory, financial, and reputational consequences. Financial services firms handling client tax data may face obligations under state breach notification laws and contractual data protection requirements.

However, no impact should be assumed until the organization confirms the incident or independent verification occurs.

What to Watch For

• Official statement from INTAX, Inc. confirming or denying the incident
• Regulatory filings or breach notifications
• Client organizations issuing their own advisories
• Publication or auction activity on the Rhysida leak site
• Credential rotation and monitoring for exposed tax portal access

Disclaimer

This report is based on an unverified claim published by a ransomware group on its leak site. Yazoul Security has NOT independently verified the breach, the data volume, the file counts, or the identities of any purported clients. Ransomware operators routinely exaggerate claims to pressure victims into payment. Nothing in this report should be treated as confirmation of a security incident. Organizations should await official confirmation and consult qualified incident response professionals.