Loading story…
The Rhysida ransomware operation has intensified its focus on healthcare, with reporting and government guidance describing an expanding threat that has hit organizations across Western Europe, the Americas, and Australia. U.S. health-sector alerts and vendor research say the group has targeted education, government, manufacturing, technology, managed service providers, and increasingly healthcare and public health entities. Researchers have also linked Rhysida to tactics associated with the defunct Vice Society operation, while earlier incidents included the leak of stolen documents from the Chilean Army and suspected involvement in disruptive attacks on medical providers.
Security reporting says Rhysida commonly gains initial access through phishing and then uses tools such as Cobalt Strike and PowerShell to disable defenses, delete shadow copies, alter RDP settings, and deploy ransomware. In a newly reported healthcare case, SIA Medical Centre was listed as a victim, with the attackers claiming theft of roughly 20,000 patient medical records along with staff identity documents, plaintext credentials, HR files, and legal and financial records. The allegedly exposed data included names, dates of birth, Medicare numbers, clinical notes, insurance files, passports, driver’s licenses, and login credentials, underscoring the group’s dual risk of operational disruption and large-scale sensitive data exposure in the health sector.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A ransomware-related data breach affecting SIA Medical Centre was discovered on August 13, 2026, and attributed to Rhysida. The attackers claimed to hold about 20,000 patient medical records, staff identity documents, plaintext credentials, HR records, and legal and financial files.
BleepingComputer reported increased scrutiny of Rhysida amid a wave of attacks on healthcare organizations, including a healthcare victim in Australia listed on the group's leak site with a one-week payment deadline. The article also cited HHS and vendor reporting that the group's activity had expanded significantly.
Trend Micro reported that Rhysida commonly gains initial access through phishing and uses Cobalt Strike and PowerShell scripts to terminate antivirus processes, delete shadow copies, and modify RDP settings before deploying ransomware. The report also assessed that reliance on external scripts suggested the locker was still under active development.
Cisco Talos reported on Rhysida's ransomware, describing its use of a 4096-bit RSA key with ChaCha20 encryption and noting exclusions for certain directories and file types. The publication documented technical characteristics of the latest locker variant.
In June 2023, Rhysida drew attention after publishing documents stolen from the Chilean Army on its data leak site. The leak was cited as an early notable incident tied to the group.
BleepingComputer reported that sources linked Rhysida to a recent cyberattack on Prospect Medical Holdings that caused a system-wide outage affecting 17 hospitals and 166 clinics in the United States. At the time, neither Rhysida had publicly claimed the attack nor Prospect confirmed the attribution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
hookphish.com
Open sourcebleepingcomputer.com
Open sourcetrendmicro.com
Open sourceblog.talosintelligence.com
Open sourceresearch.checkpoint.com
Open sourcehhs.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cookeville Regional Medical Center in Tennessee disclosed that a ransomware attack tied to the **Rhysida** gang exposed the personal, financial, and protected health information of **337,917 individuals**. The hospital said an unauthorized party accessed its network between **July 11 and July 14, 2025**, and a forensic investigation later determined that files may have been viewed or stolen during that period. Exposed data varied by individual and could include names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial account details, medical information, medical record numbers, and health insurance information. Rhysida claimed responsibility for the intrusion, saying it exfiltrated about **538 GB** of data and later listed the medical center on its dark web leak site, where it said **70%** of the data had been leaked. The breach was initially reported to HHS with a placeholder figure before a full file review was completed in March 2026, after which the hospital began broader notifications. Cookeville Regional said it has not found evidence of misuse so far, urged affected people to monitor accounts and explanation-of-benefits statements, and offered **12 months** of credit monitoring and identity theft protection.
Jun 29, 2026
Richmond Behavioral Health Authority (RBHA) and MedStar Health, two major healthcare providers in the Mid-Atlantic region, have disclosed significant ransomware incidents resulting in the exposure of sensitive patient data. RBHA reported that hackers gained unauthorized access to its systems on September 29, 2025, deploying ransomware that encrypted files containing personal and protected health information for up to 113,232 individuals. Although RBHA stated there was no definitive evidence of patient data being accessed, the organization is notifying all potentially affected individuals and has implemented enhanced security measures, including third-party monitoring and stronger data policies. MedStar Health, which operates hospitals and care sites across Maryland, Virginia, and Washington D.C., confirmed a separate ransomware attack attributed to the Rhysida group, which claims to have exfiltrated 3.7 terabytes of data, including over 7 million pieces of patient information. The breach, occurring between September 12 and 16, 2025, involved the compromise of names, dates of birth, Social Security numbers, and detailed patient care information. MedStar has begun notifying affected patients and is offering complimentary identity monitoring services to those whose most sensitive data was exposed. Both incidents highlight the ongoing threat of ransomware to healthcare organizations and the significant risks to patient privacy and data security.
Jun 29, 2026
The British Library said personal data stolen in its 31 October cyberattack was leaked online and appeared to be offered for sale, with evidence indicating the material came from internal HR records. Images posted by the attackers appeared to show employment contracts and passport information, and the library warned that employee data had been exposed while major disruption continued across its website, online systems, reading rooms, and public Wi‑Fi. The institution urged users to change any reused passwords and said it was working with the UK National Cyber Security Centre, the Metropolitan Police, and external cybersecurity specialists. The ransomware group **Rhysida** claimed responsibility and advertised the stolen data on its leak site with a starting bid of **20 bitcoin**, in what researchers described as a **double-extortion** operation combining system encryption with data theft. US agencies including the FBI and CISA had recently warned that Rhysida has targeted organizations across education, manufacturing, IT, and government, while private-sector researchers linked the group to attacks in Europe, the Middle East, and the Americas and assessed it may be a rebrand of the older **Vice Society** operation. Analysts said Rhysida commonly gains access through phishing or compromised VPN accounts and uses ransom notes titled `CriticalBreachDetected`.
Jun 29, 2026