Pope and Johnson County Title Hit by Rhysida (Nov 2026)

Claim Summary

The Rhysida ransomware group has allegedly listed “Here at Pope and Johnson County Title Company” on its dark web leak site, purportedly claiming to have exfiltrated approximately 784GB across 2,536,208 files. According to the threat actor, the attack was dated November 3, 2026. The victim is described as a title insurance and escrow agency operating in Russellville, Arkansas, with purported affiliated entities including Johnson County Title, Carol Collins Law, Principle Escrow, and Principle Intermediary.

As with all leak site postings, these claims are unverified and should be treated as assertions by the threat actor rather than established fact. Rhysida has not provided independent proof of the data’s authenticity, and the organization has not publicly confirmed the incident at the time of writing.

Threat Actor Profile

rhysida is a ransomware-as-a-service operation that emerged in mid-2023 and has been linked by multiple security researchers to financially motivated actors. The group is known for double extortion, exfiltrating data before encrypting victim systems and threatening publication to pressure payment. Rhysida has historically targeted healthcare, education, government, and manufacturing sectors, and has been observed exploiting known vulnerabilities in internet-facing systems as an initial access vector.

Publicly documented tradecraft associated with Rhysida includes the use of Cobalt Strike and other post-exploitation frameworks, living-off-the-land binaries, and exfiltration via common file transfer utilities. The group has also been observed auctioning stolen data on its leak site, a tactic intended to maximize leverage. Note that no group-specific YARA rules or detection signatures are included here; defenders should consult their threat intelligence vendor for current indicators, which are not reproduced in this report.

Alleged Data Exposure

The threat actor claims the data set includes sensitive personal and financial information. According to the posting, this purportedly includes Social Security numbers, tax identifiers, W-2 and 1099 forms, identity document scans, escrow ledgers, wire instructions, and law-practice case files. The group also alleges the presence of plaintext passwords and security answers.

Yazoul Security has not reviewed, validated, or obtained any of this data. We do not reproduce samples, credentials, or access details. The specificity of the claim is a common pressure tactic and does not constitute confirmation. Organizations and individuals potentially affected should await official notification rather than act on the threat actor’s assertions.

Potential Impact

If the claims are accurate, the alleged exposure of tax identifiers, identity documents, and escrow-related financial records could present significant regulatory, legal, and reputational risk for a financial services firm. Title and escrow agencies handle sensitive real estate transaction data and are subject to various state and federal obligations. However, the scale and contents remain unverified. Ransomware groups routinely exaggerate data volumes and sensitivity to increase pressure on victims. Any impact assessment should be based on forensic findings, not leak site claims.

What to Watch For

• Official statements from the organization or its affiliates confirming or denying the incident.
• Regulatory or breach notifications to affected clients and counterparties.
• Indicators of Rhysida tradecraft in related environments, such as unusual lateral movement or exfiltration activity.
• Updates to the leak site, including countdown timers or data publication claims.
• Guidance from Yazoul Security advisories at /advisory/ as the situation develops.

Disclaimer

This report is based solely on an unverified claim published by a ransomware group on its leak site. Nothing in this document has been independently verified by Yazoul Security. The organization named has not confirmed the incident, and the data volume, contents, and scope are assertions by the threat actor only. Ransomware operators frequently misrepresent or inflate claims. Readers should treat all details as alleged and await official confirmation or forensic reporting before drawing conclusions.