Rhysida
Data as of August 16, 2026.
Credential exposure before the attack
33.9% of Rhysida victims whose domain we can identify (98 of 289) had employee credentials leak in the 12 months before Rhysida named them as a victim.
We don't know whether any of these credentials were how Rhysida gained initial access.
What industries Rhysida targets
Sector identified for 193 of 289 victims.
| Education | 55 | |
| Healthcare | 39 | |
| Manufacturing | 28 | |
| Government | 11 | |
| Legal | 10 | |
| Financial Services | 10 | |
| Technology | 8 | |
| Construction | 8 |
Where the victims are located
Country identified for 147 of 289 victims.
| United States | 54 | |
| Canada | 15 | |
| Italy | 11 | |
| Germany | 9 | |
| United Kingdom | 9 | |
| Australia | 6 | |
| Brazil | 6 | |
| Peru | 4 |
Most recent Rhysida victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| SIA Medical Centre siamed.com.au | Healthcare | Australia | Aug 14, 2026 |
| Lawson Roofing lawsonroofing.com | Construction | United States | Jun 19, 2026 |
| IDS Group idsgi.com | Not identified | United States | May 26, 2026 |
| Landeshauptstadt Stuttgart stuttgart.de | Education | Germany | May 20, 2026 |
| Tower View Primary School sch.uk | Education | United Kingdom | May 18, 2026 |
| Stelia North America stelia-northamerica.com | Manufacturing | United States | Apr 28, 2026 |
| Town of Southold southoldtownny.gov | Government | United States | Mar 3, 2026 |
| RohnerRohner Finishing Systems rohnerspraybooths.com | Manufacturing | United States | Feb 24, 2026 |
| Cheyenne and Arapaho Tribes cheyenneandarapaho-nsn.gov | Government | United States | Feb 18, 2026 |
| Phoenix Art Museum phxart.org | Not identified | United States | Feb 13, 2026 |
| Lakeside Union School District lakesideusd.org | Education | United States | Feb 4, 2026 |
| Elabs Logo elabs.de | Manufacturing | Germany | Feb 3, 2026 |
| Mact Health Board macthealth.org | Healthcare | United States | Jan 29, 2026 |
| Cytek Biosciences cytekbio.com | Not identified | United States | Jan 26, 2026 |
| Jet Care jet-care.com | Manufacturing | United States | Jan 22, 2026 |
| Larry Pitt & Associates larrypitt.com | Legal | United States | Dec 22, 2025 |
| Yokosuka Gakuin yokosukagakuin.ac.jp | Education | Japan | Dec 16, 2025 |
| United Keetoowah Band of Cherokee Indians in Oklahoma ukb-nsn.gov | Government | United States | Dec 15, 2025 |
| Kane\'s Furniture kanesfurniture.com | Retail | United States | Dec 8, 2025 |
| Sodise sodise.com | Manufacturing | France | Dec 8, 2025 |
Showing the 20 most recent of 289. Browse recent data breaches for more.
Rhysida leak sites
Addresses we've seen Rhysida publish victims from. Any .onion address needs the Tor Browser.
rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onionrhysidaeoxtkejwuheks3a7htk4zn3dfuynt5mqw6oawlcx6kcxjdeyd.onionrhysidaqho36b6i6mvpmy5di4ro5zglovtxixrirky6q3fgack7q5uyd.onionrhysidaiqemmlrvn2jvncdwhkvuiv7s2iu342xnrpeynxoe6r2dtjfyd.onionrhysida6qqkj5ahjfshlepbhk7m2sgqc25y5iznmabcch2i7pbw4g6yd.onionrhysidalpxnejirgq5iqkryy3lbpm7vuqd4khj7tvkme2b7y3d5srpqd.onionrhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onionrhysidak3albqccbw3rnvjygzjyapal3c2y2zuix755extjalabkviyd.onionwww.leadingedgespecializeddentistry.comwww.msn.commynjdentist.comalphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onionsbc2zv2qnz5vubwtx3aobfpkeao6l4igjegm3xx7tk5suqhjkp5jxtqd.onionakiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onioncloak7jpvcb73rtx2ff7kaw2kholu7bdiivxpzbhlny4ybz75dpxckqd.onionhunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onionbianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion
Rhysida questions
Is Rhysida still active?
Yes. Rhysida posted its most recent victim on August 14, 2026.
How many victims has Rhysida claimed?
Rhysida has named 289 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 51 of them were posted in the last 12 months.
When did Rhysida first appear?
The first victim we recorded for Rhysida was posted on January 2, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Rhysida target?
Education accounts for the most victims we can classify, with 55. Healthcare follows at 39. We could identify a sector for 193 of 289 victims, so treat this as the shape of the targeting rather than a full census.
Has Rhysida already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.