Rhysida 2026 activity
Ransomware group. 5 reports in 4 countries: 1 confirmed, 4 claimed or disputed. Latest 30 Oct 2026.
Malaysia · 
Vietnam · 
Philippines · 
Germany
🎯 What sources say
- Germany: Claimed the August 2026 data theft from Berlin's city administration. BleepingComputer
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
 ⚠️ ClaimedINTI International University | Malaysia | 30 Oct 2026 | Education | Ransomware | Rhysida | Claimed. Listed on Rhysida's leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedMISC GroupKuala Lumpur | Malaysia | 26 Oct 2026 | Transport | Ransomware | Rhysida | Claimed. Listed on Rhysida's leak site, which claims crew data and vessel system credentials. | DeXpose✓ 7 Nov |
 ⚠️ ClaimedMat Bao Corporation | Vietnam | 2 Oct 2026 | Other | Ransomware | Rhysida | Claimed. Rhysida claims about 106.8 GB from the hosting and domain provider. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedGeneral Santos Doctors Hospital | Philippines | 10 Sep 2026 | Health | Ransomware | Rhysida | Claimed. Listed on Rhysida's leak site. | ransomware.live✓ 7 Nov |
 ✅ ConfirmedBerlin Senate administration | Germany | 14 Aug 2026 | Government | Ransomware | Rhysida | Confirmed. Berlin confirmed extortion attempts after data theft, disconnected affected Senate departments on 14 August, and the mayor said the city will not pay. Claimed. Rhysida claimed 5.79 TB of administrative files, including HR, financial and water-supply security documents. | BleepingComputer✓ 7 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology