Incidents attributed to:
The State of Berlin disclosed an extortion attempt after the Rhysida ransomware group stole data from the Senate administrations for urban development and for mobility, claiming 5.79 TB and demanding 30 bitcoin; Berlin refused to pay.
CNPC USA was named on the Rhysida ransomware data-leak (extortion) site on 2025-06-16.
Hudson River Housing was named on the Rhysida ransomware data-leak (extortion) site on 2025-06-07.
Cator Ruma & Associates was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-28.
Carrera Chevrolet was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-26.
Florida Lung was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-20.
Termolar was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-18.
Sao Camilo Cachoeiro de Itapemirim was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-14.
Mountain View Mushrooms was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-09.
Mediprobe Research was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-06.
Kalin Hobeltechnik was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-03.
Government of Peru was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-02.
Coop UQAM was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-30.
LaBella Associates was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-28.
MDB was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-26.
Milicic was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-23.
Acos Favorit was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-22.
Oregon Department of Environmental Quality was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-15.
Dimension Composite was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-12.
Swiss Capitals Group was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-06.
Clarity Ventures was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-02.
Forrest City School District was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-29.
Senior Support Services was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-29.
Okeene Elementary School was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-25.