We've just wrapped up the new design, along with a ton of other improvements. Check them all out in the Changelog.

Ransomware Group intelligence

Rhysida

Active

Track Rhysida with 315 published victims and 10 known leak locations in a single intelligence view.

DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Victims 315 Known published victims in this dataset
First discovered 2023-06-05 Earliest victim discovery date
Last discovered 2026-10-30 Latest victim discovery date
Inactive since 0 days Days since the latest known victim
Top country United States 142 victims
Known locations 10 Leak or negotiation infrastructure tracked

Overview

Rhysida is tracked by Dark Eye as a ransomware group with 315 published victims.

United States is currently the most targeted country in this dataset.

10 known leak locations are currently associated with this group.

Leak Status Distribution

  • Leaked 37 11.7%
  • Pending 277 87.9%
  • Deleted 1 0.3%

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (10)

    Label Type Availability Links
    Leak location 10 Onion service Up checked 5h ago rhysidaxx6gdihss7urv4ecbh2yz4izhnfulfbrb4ua5dwkocm653yid.onion
    Leak location 4 Onion service Up checked 5h ago rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion
    Leak location 7 Onion service Up checked 5h ago rhysidaqho36b6i6mvpmy5di4ro5zglovtxixrirky6q3fgack7q5uyd.onion
    Leak location 1 Onion service Up checked 5h ago rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
    Leak location 2 Onion service Up checked 5h ago rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
    Leak location 3 Onion service Up checked 5h ago rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
    Leak location 9 Onion service Down checked 5h ago rhysidaiqemmlrvn2jvncdwhkvuiv7s2iu342xnrpeynxoe6r2dtjfyd.onion
    Leak location 8 Onion service Down checked 5h ago rhysida6qqkj5ahjfshlepbhk7m2sgqc25y5iznmabcch2i7pbw4g6yd.onion
    Leak location 6 Onion service Down checked 5h ago rhysidaeoxtkejwuheks3a7htk4zn3dfuynt5mqw6oawlcx6kcxjdeyd.onion
    Leak location 5 Onion service Down checked 5h ago grhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion

    Top Activity Sectors (18)

    Victims (315)

    Search, filter and paginate the victim timeline for Rhysida. Showing 101–200 of 315.

    Type Target Discovered Country Business Category Intel Link Leak status
    Ransomware Cardinal Services id21656 View details United States Services pending
    Ransomware Florida Hand Center id21655 View details United States Healthcare / Pharma pending
    Ransomware Welthungerhilfe id20885 View details Germany Communication / Marketing leaked
    Ransomware Coreix id21654 View details United Kingdom IT pending
    Ransomware CNPC USA id21653 View details United States Other leaked
    Ransomware Hudson River Housing id21652 View details United States Construction / Real Estate pending
    Ransomware Cator Ruma & Associates id21651 View details United States Public Sector pending
    Ransomware Carrera Chevrolet id21650 View details Brazil Other pending
    Ransomware Florida Lung id21649 View details United States Healthcare / Pharma pending
    Ransomware Termolar id21648 View details Brazil Communication / Marketing pending
    Ransomware Sao Camilo Cachoeiro de Itapemirim id20012 View details Brazil Education pending
    Ransomware Mountain View Mushrooms id19946 View details United States Communication / Marketing — pending
    Ransomware Mediprobe Research id19756 View details Canada Communication / Marketing pending
    Ransomware Kalin Hobeltechnik id19717 View details Switzerland IT pending
    Ransomware Government of Peru id19681 View details Peru Public Sector — pending
    Ransomware Coop UQAM id19636 View details Canada Education pending
    Ransomware LaBella Associates id19606 View details United States Manufacturing / Engineering leaked
    Ransomware MDB id19577 View details United States Other — pending
    Ransomware Milicic id19315 View details Argentina Construction / Real Estate pending
    Ransomware Acos Favorit id19287 View details Norway Manufacturing / Engineering — pending
    Ransomware Oregon Department of Environmental Quality id19164 View details United States Public Sector — pending
    Ransomware Dimension Composite id19103 View details Canada Manufacturing / Engineering — pending
    Ransomware Swiss Capitals Group id18993 View details Switzerland Finance / Legal / Insurance pending
    Ransomware Clarity Ventures id18909 View details United States Retail / E-commerce — pending
    Ransomware Forrest City School District id18772 View details United States Education pending
    Ransomware Senior Support Services id18740 View details Canada Services — pending
    Ransomware Okeene Elementary School id18684 View details United States Education pending
    Ransomware Ted Hosmer Enterprises id18505 View details United States Communication / Marketing — pending
    Ransomware Cothron's Security Professionals id18404 View details United States Communication / Marketing — pending
    Ransomware British virgin islands London Office id18264 View details United Kingdom Communication / Marketing — pending
    Ransomware Best Collateral, Inc. id18178 View details United States Retail / E-commerce — pending
    Ransomware Newton & Associates, Inc id18106 View details United States Finance / Legal / Insurance — pending
    Ransomware Peter Glenn Ski Sport id17707 View details United States Retail / E-commerce — pending
    Ransomware Buanderie Centrale de Montreal id17604 View details Canada NGOs / Associations — pending
    Ransomware The Agency id17521 View details — Communication / Marketing — pending
    Ransomware Leading Edge Specialized Dentistry id17459 View details — Healthcare / Pharma — pending
    Ransomware Hammond Trucking & Excavation id17458 View details United States Transportation / Travel / Logistics — pending
    Ransomware BH Aircraft Company, Inc. id17457 View details United States Communication / Marketing leaked
    Ransomware My New Jersey Dentist id17456 View details United States Healthcare / Pharma leaked
    Ransomware Town Counsel Law & Litigation id17455 View details United States Finance / Legal / Insurance pending
    Ransomware Pembina Trails School Division id17070 View details Canada Education leaked
    Ransomware Carthage Police Department id16957 View details United States Public Sector — pending
    Ransomware ORU Mabee Center id16820 View details United States Healthcare / Pharma pending
    Ransomware ORU Mabee Center id33158 United States Healthcare / Pharma pending
    Ransomware TG3 Electronics id16716 View details United States Other — pending
    Ransomware The Chicano Federation id16654 View details United States NGOs / Associations — pending
    Ransomware Qualinet id16576 View details Canada Other — pending
    Ransomware Sunflower Medical Group id16520 View details United States Healthcare / Pharma — pending
    Ransomware Montreal North id16489 View details Canada Public Sector — pending
    Ransomware T Smiles Dental id16383 View details Canada Healthcare / Pharma — pending
    Ransomware Avstar Fuel Systems id16156 View details United States Energy — pending
    Ransomware Rutherford County Schools id15977 View details United States Education — pending
    Ransomware Matlock Security Services id15904 View details United States Services — pending
    Ransomware Goodwill North Central Texas id15806 View details United States Hospitality / Food & Beverage / Tourism — pending
    Ransomware Delmar International id15719 View details Canada Transportation / Travel / Logistics — pending
    Ransomware Vermilion Parish School System id15664 View details United States Education pending
    Ransomware Bishop Ireton High School id15531 View details United States Retail / E-commerce — pending
    Ransomware American Addiction Centers id15359 View details United States Telecommunications — pending
    Ransomware Granite School District id15237 View details United States Education — pending
    Ransomware Fylde Coast Academy Trust id15161 View details United Kingdom Education — pending
    Ransomware Hope Valley Recovery id15104 View details United States Communication / Marketing — pending
    Ransomware De Rose Lawyers id14980 View details Canada Finance / Legal / Insurance — pending
    Ransomware Easterseals id14905 View details United States Services — pending
    Ransomware Henry County Schools id14778 View details United States Education — pending
    Ransomware Microworks id14768 View details Japan Hospitality / Food & Beverage / Tourism — pending
    Ransomware Axis Health System id14720 View details United States Healthcare / Pharma — pending
    Ransomware Golden Age Nursing Home id14570 View details Australia Healthcare / Pharma — pending
    Ransomware Plastics Plus id14515 View details Canada Manufacturing / Engineering — pending
    Ransomware Shenango Area School District id14471 View details United States NGOs / Associations pending
    Ransomware Daughterly Care id14408 View details Australia Communication / Marketing — pending
    Ransomware Greene Acres Nursing Home id14392 View details United States Healthcare / Pharma — pending
    Ransomware Port of Seattle/Seattle-Tacoma International Airport (SEA) id14348 View details United States Transportation / Travel / Logistics — pending
    Ransomware Qeco/coeq id14232 View details United States Education — pending
    Ransomware Pennsylvania State Education Association id14227 View details United States Education — pending
    Ransomware Stratford School Academy id14211 View details United Kingdom Education — pending
    Ransomware Project Hospitality id14142 View details United States Healthcare / Pharma — pending
    Ransomware White Mountain Backpacks id14132 View details Australia Other pending
    Ransomware Sports & Spine Orthopaedics id14112 View details United States Other — pending
    Ransomware Corbally Gartland and Rappleyea id14060 View details Ireland Finance / Legal / Insurance — pending
    Ransomware NewsBank id13990 View details United States Finance / Legal / Insurance — pending
    Ransomware Affordable Tools id13987 View details United States Communication / Marketing — pending
    Ransomware Kronick Moskovitz Tiedemann & Girard id13947 View details United States Other — pending
    Ransomware Engedi id13940 View details Australia Communication / Marketing — pending
    Ransomware Olympus Financial id13913 View details United States Finance / Legal / Insurance — pending
    Ransomware Waynesboro Nurseries id13898 View details United States Public Sector — pending
    Ransomware Sterling Rope id13860 View details United States Manufacturing / Engineering pending
    Ransomware Sterling Rope id33169 United States Manufacturing / Engineering pending
    Ransomware Liberty Resources id13839 View details United States Other — pending
    Ransomware The Washington Times id13831 View details United States Other — pending
    Ransomware The White Center Community Development Association id13808 View details United States NGOs / Associations — pending
    Ransomware Moser Wealth Advisors id13780 View details United States Finance / Legal / Insurance — pending
    Ransomware Sumter County Sheriff id13747 View details United States Public Sector — pending
    Ransomware Bayhealth Hospital id13727 View details United States Healthcare / Pharma — pending
    Ransomware Maryville Academy id13687 View details United States Education — pending
    Ransomware Ranney School id13684 View details United States Education — pending
    Ransomware City of Columbus, Ohio id13622 View details United States Public Sector — pending
    Ransomware New Jersey City University id13587 View details United States Education — pending
    Ransomware Computer Networking Solutions id13586 View details United States Services — pending
    Ransomware Community Care Alliance id13583 View details United States Communication / Marketing — pending
    Ransomware LawDepot id13477 View details United States Finance / Legal / Insurance — pending