Phoenix Charter Academy Ransomware Claim by Rhysida (Oct 2026)

Claim Summary

The Rhysida ransomware group has allegedly listed Phoenix Charter Academy, a public charter school network in Massachusetts operating campuses in Chelsea, Lawrence, and Springfield, on its dark web leak site. According to the threat actor, the attack was purportedly carried out on October 31, 2026, and the group claims to have exfiltrated approximately 445.1 GB of data across 36,829 files.

This claim has NOT been independently verified by Yazoul Security. It represents only the assertion of the ransomware operator and should be treated with significant skepticism until confirmed through official channels or independent forensic analysis.

Threat Actor Profile

rhysida is a ransomware-as-a-service (RaaS) operation that emerged in mid-2023 and has been observed targeting organizations across healthcare, education, manufacturing, and government sectors. The group is known for double extortion tactics, exfiltrating data before encryption and threatening publication to pressure victims into payment.

Public reporting has associated Rhysida with the use of Cobalt Strike beacons, remote monitoring and management (RMM) tooling, and living-off-the-land techniques for lateral movement. The group has historically demanded payments in cryptocurrency and has occasionally auctioned stolen data. However, Rhysida, like many RaaS affiliates, has a documented tendency to exaggerate the scope and sensitivity of stolen data to maximize leverage. Claims of complete domain compromise and extensive personal records should be assessed against this pattern of inflation.

No public YARA rules or detection signatures specific to this campaign are available at the time of writing. Organizations should rely on general Rhysida detection guidance, including monitoring for Cobalt Strike activity and anomalous RMM tool installations.

Alleged Data Exposure

According to the threat actor, the purported dataset includes:

• Domain controller password hashes for approximately 170+ staff accounts
• File, helpdesk, and print server data
• A PowerSchool test server described as containing student database information
• Special-education records of named minors, including IEP/504 plans, BASC-3 protocols, and speech-therapy files
• Immigration records of students’ families, including CBP I-94 entry records
• Staff W-2 forms, passport scans, bank statements, and CORI background-check files
• Medical data including MassHealth cards and immunization records
• Municipal compliance and inspection files

Yazoul Security has not reviewed, verified, or accessed any of this material. The sensitivity of the alleged records, particularly those involving minors and immigration status, makes this claim especially serious if substantiated. However, ransomware groups frequently misrepresent data contents or pad claims with unrelated files.

Potential Impact

If the claim is accurate, the exposure could affect students, families, and staff across three campuses serving predominantly low-income and immigrant communities. Potential consequences include identity theft, financial fraud, targeted phishing, and serious privacy harms for minors and non-citizen families. Regulatory exposure under FERPA, HIPAA (where applicable to health records), and Massachusetts data protection law could be significant.

What to Watch For

• Official statements from Phoenix Charter Academy or Massachusetts education authorities
• Notifications to affected families and staff
• Regulatory filings or breach disclosures
• Independent forensic reporting confirming or refuting the scope

Disclaimer

This report is based solely on an unverified claim published by the Rhysida ransomware group. Yazoul Security has NOT independently confirmed the attack, the data theft, or the contents described. No PII, credentials, samples, or access details are included here by design. Treat all assertions as allegations until verified by the organization or qualified investigators.