CNPC USA ransomware attack (Rhysida, 2025)
CNPC USA was named on the Rhysida ransomware data-leak (extortion) site on 2025-06-16.
- Victim
- CNPC USA
Incidents attributed to:
Rhysida
Related incidents
Hudson River Housing ransomware attack (Rhysida, 2025)
Hudson River Housing was named on the Rhysida ransomware data-leak (extortion) site on 2025-06-07.
- Victim
- Hudson River Housing
Cator Ruma & Associates ransomware attack (Rhysida, 2025)
Cator Ruma & Associates was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-28.
- Victim
- Cator Ruma & Associates
Carrera Chevrolet ransomware attack (Rhysida, 2025)
Carrera Chevrolet was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-26.
- Victim
- Carrera Chevrolet
Florida Lung ransomware attack (Rhysida, 2025)
Florida Lung was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-20.
- Victim
- Florida Lung
Termolar ransomware attack (Rhysida, 2025)
Termolar was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-18.
- Victim
- Termolar
Sao Camilo Cachoeiro de Itapemirim ransomware attack (Rhysida, 2025)
Sao Camilo Cachoeiro de Itapemirim was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-14.
- Victim
- Sao Camilo Cachoeiro de Itapemirim
Mountain View Mushrooms ransomware attack (Rhysida, 2025)
Mountain View Mushrooms was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-09.
- Victim
- Mountain View Mushrooms
Mediprobe Research ransomware attack (Rhysida, 2025)
Mediprobe Research was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-06.
- Victim
- Mediprobe Research
Kalin Hobeltechnik ransomware attack (Rhysida, 2025)
Kalin Hobeltechnik was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-03.
- Victim
- Kalin Hobeltechnik
Government of Peru ransomware attack (Rhysida, 2025)
Government of Peru was named on the Rhysida ransomware data-leak (extortion) site on 2025-05-02.
- Victim
- Government of Peru
Coop UQAM ransomware attack (Rhysida, 2025)
Coop UQAM was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-30.
- Victim
- Coop UQAM
LaBella Associates ransomware attack (Rhysida, 2025)
LaBella Associates was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-28.
- Victim
- LaBella Associates
MDB ransomware attack (Rhysida, 2025)
MDB was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-26.
- Victim
- MDB
Milicic ransomware attack (Rhysida, 2025)
Milicic was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-23.
- Victim
- Milicic
Acos Favorit ransomware attack (Rhysida, 2025)
Acos Favorit was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-22.
- Victim
- Acos Favorit
Oregon Department of Environmental Quality ransomware attack (Rhysida, 2025)
Oregon Department of Environmental Quality was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-15.
- Victim
- Oregon Department of Environmental Quality
Dimension Composite ransomware attack (Rhysida, 2025)
Dimension Composite was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-12.
- Victim
- Dimension Composite
Swiss Capitals Group ransomware attack (Rhysida, 2025)
Swiss Capitals Group was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-06.
- Victim
- Swiss Capitals Group
Clarity Ventures ransomware attack (Rhysida, 2025)
Clarity Ventures was named on the Rhysida ransomware data-leak (extortion) site on 2025-04-02.
- Victim
- Clarity Ventures
Forrest City School District ransomware attack (Rhysida, 2025)
Forrest City School District was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-29.
- Victim
- Forrest City School District
Senior Support Services ransomware attack (Rhysida, 2025)
Senior Support Services was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-29.
- Victim
- Senior Support Services
Okeene Elementary School ransomware attack (Rhysida, 2025)
Okeene Elementary School was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-25.
- Victim
- Okeene Elementary School
Ted Hosmer Enterprises ransomware attack (Rhysida, 2025)
Ted Hosmer Enterprises was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-18.
- Victim
- Ted Hosmer Enterprises
Cothron's Security Professionals ransomware attack (Rhysida, 2025)
Cothron's Security Professionals was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-13.
- Victim
- Cothron's Security Professionals
British virgin islands London Office ransomware attack (Rhysida, 2025)
British virgin islands London Office was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-09.
- Victim
- British virgin islands London Office
Best Collateral, Inc. ransomware attack (Rhysida, 2025)
Best Collateral, Inc. was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-05.
- Victim
- Best Collateral, Inc.
Newton & Associates, Inc ransomware attack (Rhysida, 2025)
Newton & Associates, Inc was named on the Rhysida ransomware data-leak (extortion) site on 2025-03-01.
- Victim
- Newton & Associates, Inc
Peter Glenn Ski Sport ransomware attack (Rhysida, 2025)
Peter Glenn Ski Sport was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-22.
- Victim
- Peter Glenn Ski Sport
Buanderie Centrale de Montreal ransomware attack (Rhysida, 2025)
Buanderie Centrale de Montreal was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-18.
- Victim
- Buanderie Centrale de Montreal
The Agency ransomware attack (Rhysida, 2025)
The Agency was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-14.
- Victim
- The Agency
Hammond Trucking & Excavation ransomware attack (Rhysida, 2025)
Hammond Trucking & Excavation was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-11.
- Victim
- Hammond Trucking & Excavation
Leading Edge Specialized Dentistry ransomware attack (Rhysida, 2025)
Leading Edge Specialized Dentistry was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-09.
- Victim
- Leading Edge Specialized Dentistry
Town Counsel Law & Litigation ransomware attack (Rhysida, 2025)
Town Counsel Law & Litigation was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-04.
- Victim
- Town Counsel Law & Litigation
My New Jersey Dentist ransomware attack (Rhysida, 2025)
My New Jersey Dentist was named on the Rhysida ransomware data-leak (extortion) site on 2025-02-01.
- Victim
- My New Jersey Dentist
BH Aircraft Company, Inc. ransomware attack (Rhysida, 2025)
BH Aircraft Company, Inc. was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-31.
- Victim
- BH Aircraft Company, Inc.
Pembina Trails School Division ransomware attack (Rhysida, 2025)
Pembina Trails School Division was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-31.
- Victim
- Pembina Trails School Division
Carthage Police Department ransomware attack (Rhysida, 2025)
Carthage Police Department was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-28.
- Victim
- Carthage Police Department
ORU Mabee Center ransomware attack (Rhysida, 2025)
ORU Mabee Center was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-24.
- Victim
- ORU Mabee Center
TG3 Electronics ransomware attack (Rhysida, 2025)
TG3 Electronics was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-19.
- Victim
- TG3 Electronics
The Chicano Federation ransomware attack (Rhysida, 2025)
The Chicano Federation was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-14.
- Victim
- The Chicano Federation
Qualinet ransomware attack (Rhysida, 2025)
Qualinet was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-10.
- Victim
- Qualinet
Sunflower Medical Group ransomware attack (Rhysida, 2025)
Sunflower Medical Group was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-07.
- Victim
- Sunflower Medical Group
Montreal North ransomware attack (Rhysida, 2025)
Montreal North was named on the Rhysida ransomware data-leak (extortion) site on 2025-01-04.
- Victim
- Montreal North
British Library Rhysida ransomware (2023)
Rhysida ransomware operators destroyed servers, demanded ~£600,000, and leaked 600 GB of internal data when the British Library refused to pay. The main catalogue did not return online — read-only — until January 2024. Recovery is consuming 40% of the Library's financial reserves.
- Victim
- British Library
- Loss
- $8.5M