Rhysida
Data as of September 14, 2026.
Credential exposure before the attack
33.2% of Rhysida victims whose domain we can identify (100 of 301) had employee credentials leak in the 12 months before Rhysida named them as a victim.
We don't know whether any of these credentials were how Rhysida gained initial access.
What industries Rhysida targets
Sector identified for 204 of 301 victims.
| Education | 56 | |
| Healthcare | 42 | |
| Manufacturing | 30 | |
| Government | 13 | |
| Financial Services | 10 | |
| Legal | 10 | |
| Technology | 8 | |
| Construction | 8 |
Where the victims are located
Country identified for 159 of 301 victims.
| United States | 60 | |
| Canada | 16 | |
| Italy | 11 | |
| Germany | 11 | |
| United Kingdom | 9 | |
| Australia | 6 | |
| Brazil | 6 | |
| France | 4 |
Most recent Rhysida victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Axdia International axdia.com | Manufacturing | Germany | Sep 14, 2026 |
| General Santos Doctors Hospital gensandoctors.com | Healthcare | Philippines | Sep 11, 2026 |
| Professional Retail Services profretail.com | Retail | United States | Sep 11, 2026 |
| Sad\'s Intérim sads-interim.eu | Not identified | France | Sep 9, 2026 |
| Rug & Home rugandhome.com | Retail | United States | Sep 8, 2026 |
| Széchenyi Programme Office Nonprofit szpi.hu | Non-profit | Hungary | Sep 2, 2026 |
| Berlin berlin.de | Government | Germany | Aug 31, 2026 |
| Valley Health Team vht.org | Healthcare | United States | Aug 31, 2026 |
| CRI Electric cri-electric.co | Manufacturing | United States | Aug 24, 2026 |
| Battle Creek Public Schools battlecreekpublicschools.org | Education | United States | Aug 22, 2026 |
| Fairview Dental Group fairviewdental.ca | Healthcare | Canada | Aug 22, 2026 |
| Pierce Township piercetownship.org | Government | United States | Aug 17, 2026 |
| SIA Medical Centre siamed.com.au | Healthcare | Australia | Aug 14, 2026 |
| Lawson Roofing lawsonroofing.com | Construction | United States | Jun 19, 2026 |
| IDS Group idsgi.com | Not identified | United States | May 26, 2026 |
| Landeshauptstadt Stuttgart stuttgart.de | Education | Germany | May 20, 2026 |
| Tower View Primary School sch.uk | Education | United Kingdom | May 18, 2026 |
| Stelia North America stelia-northamerica.com | Manufacturing | United States | Apr 28, 2026 |
| Town of Southold southoldtownny.gov | Government | United States | Mar 3, 2026 |
| RohnerRohner Finishing Systems rohnerspraybooths.com | Manufacturing | United States | Feb 24, 2026 |
Showing the 20 most recent of 301. Browse recent data breaches for more.
Rhysida leak sites
Addresses we've seen Rhysida publish victims from. Any .onion address needs the Tor Browser.
rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onionrhysidaeoxtkejwuheks3a7htk4zn3dfuynt5mqw6oawlcx6kcxjdeyd.onionrhysidaqho36b6i6mvpmy5di4ro5zglovtxixrirky6q3fgack7q5uyd.onionrhysidaiqemmlrvn2jvncdwhkvuiv7s2iu342xnrpeynxoe6r2dtjfyd.onionrhysida6qqkj5ahjfshlepbhk7m2sgqc25y5iznmabcch2i7pbw4g6yd.onionrhysidalpxnejirgq5iqkryy3lbpm7vuqd4khj7tvkme2b7y3d5srpqd.onionrhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onionrhysidak3albqccbw3rnvjygzjyapal3c2y2zuix755extjalabkviyd.onionhunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onionbianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onionalphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onionsbc2zv2qnz5vubwtx3aobfpkeao6l4igjegm3xx7tk5suqhjkp5jxtqd.onionakiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onioncloak7jpvcb73rtx2ff7kaw2kholu7bdiivxpzbhlny4ybz75dpxckqd.onionwww.leadingedgespecializeddentistry.comwww.msn.commynjdentist.com
Rhysida questions
Is Rhysida still active?
Yes. Rhysida posted its most recent victim on September 14, 2026. That's 12 victims in the last 30 days.
How many victims has Rhysida claimed?
Rhysida has named 301 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 58 of them were posted in the last 12 months.
When did Rhysida first appear?
The first victim we recorded for Rhysida was posted on January 2, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Rhysida target?
Education accounts for the most victims we can classify, with 56. Healthcare follows at 42. We could identify a sector for 204 of 301 victims, so treat this as the shape of the targeting rather than a full census.
Has Rhysida already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.