Rhysida Ransomware

The Rhysida ransomware group, a malicious software entity, has been actively launching cyberattacks since May 2023. Their modus operandi involves infiltrating systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, they exploit and damage the system, stealing personal information, disrupting operations, or holding data hostage for ransom. The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have issued warnings about the activities of this ransomware gang, highlighting the severity and widespread nature of their attacks. In August 2024, the Port of Seattle confirmed that it fell victim to an attack by the Rhysida ransomware group. This cyberattack affected critical systems, including those at the Seattle-Tacoma International Airport. In another significant incident, the group is believed to have knocked systems offline at Chicago's Lurie Children's Hospital, compromising records belonging to more than 790,000 patients. These attacks demonstrate the group's capacity to target and disrupt major infrastructure and healthcare services. The Rhysida ransomware group has also shown its willingness to leak stolen data if their ransom demands are not met. In July, after initially attacking the city of Columbus and demanding $1.9 million in Bitcoin, the group released 6.5 terabytes of data when the city refused to pay. Earlier in August, they leaked 3.1TB of data on their Tor-based site, claiming it was stolen from Columbus' systems. This data allegedly included sensitive information such as passports and Social Security numbers, underscoring the serious implications of these cyberattacks.