Privacy UnpackedRansomware gang
Rhysida
Claims on its leak site since 5 June 2023, number 33 of all gangs in the last 12 months
- Claims, 12 months
- 76
- Last 30 days
- 17
- All claims
- 308
- Last claim
- 28 October 2026
Where its claimed victims are
Sectors
Claims matched to an official notice
15 organisations Rhysida claimed also filed a breach notice with a regulator, 13 of them after the claim (a median of 118 days later). Matched by name: the notice does not say who the attacker was.
- Woodard, Emhardt, Henry, Reeves, & Wagner LLC
Claimed 11 December 2025 · notice filed with the Indiana Attorney General 14 August 2026 - The Lawson Roofing Co Inc.
Claimed 18 June 2026 · notice filed with the California Attorney General 22 July 2026 - Bellflower Unified School District
Claimed 28 October 2025 · notice filed with the California Attorney General 12 June 2026 - MACT Health Board Inc.
Claimed 29 January 2026 · notice filed with the California Attorney General 23 January 2026 - Pennsylvania State Education Association
Claimed 9 September 2024 · notice filed with the Washington Attorney General 18 March 2025 - Best Collateral Inc.
Claimed 5 March 2025 · notice filed with the California Attorney General 6 March 2025 - Kronick Moskovitz Tiedemann & Girard
Claimed 22 August 2024 · notice filed with the California Attorney General 28 February 2025 - American Addiction Centers, Inc.
Claimed 16 November 2024 · notice filed with the Washington Attorney General 20 December 2024 - Moser Wealth Advisors
Claimed 11 August 2024 · notice filed with the Washington Attorney General 28 August 2024 - OLYMPUS FINANCIAL
Claimed 21 August 2024 · notice filed with the California Attorney General 6 August 2024 - MarineMax, Inc.
Claimed 20 March 2024 · notice filed with the California Attorney General 16 July 2024 - Ann & Robert H. Lurie Children’s Hospital Of Chicago
Claimed 27 February 2024 · notice filed with the California Attorney General 27 June 2024 - Western National Group
Claimed 29 June 2023 · notice filed with the California Attorney General 1 March 2024 - Insomniac Games
Claimed 12 December 2023 · notice filed with the California Attorney General 22 February 2024 - Prospect Medical Holdings, Inc.
Claimed 24 August 2023 · notice filed with the California Attorney General 29 September 2023
What a claim is, and is not
A claim is a ransomware gang naming an organisation on its leak site, usually to pressure it into paying. It is the gang’s word: some claims are false, recycled from older breaches or exaggerated, and a claim says nothing about whose personal data, if any, was taken. That is why we count claims but do not list the organisations, and why a breach goes on the tracker as confirmed only when the organisation or a regulator says so.
How this is counted
Claims as collected from the gangs’ leak sites by ransomware.live, which says itself that they are unverified. We read its list every day and keep only counts: by month, by the victim’s country and by sector (as ransomware.live classifies them). Matches with official notices are by the organisation’s name, from 30 days before the claim to a year after it, against California’s and Washington’s full breach registers and every official notice on the tracker. A match is not a confirmation rate: those registers only see breaches of their own residents, and names are written differently. We never link to or visit leak sites.
From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Found a mistake? Tell us and we correct it.