Exclusive: Rhysida ransomware gang claims to have hacked disability support organization Engedi
Queensland-based registered NDIS provider Engedi was hit by a suspected ransomware attack and staff data was published on the dark web.
The Rhysida ransomware operation included a Mackay-based disability support provider as one of its latest victims.
Rhysida posted details of the attack on August 22 on its darknet leak site, along with documents the gang claims were taken from Engedi’s network.
“With only seven days left on the clock, take the opportunity to bid on exclusive, unique and impressive data,” Rhysida said in the post, using her usual boilerplate copy.
“Open your wallets and prepare to purchase exclusive data. We sell only one hand, we do not resell, you will be the sole owner!
Engedi, and anyone else interested in purchasing, was given seven days to purchase the data for a sum of 10 bitcoins, which is equivalent to about $94,000 in Australian currency at the time of writing.
The hacking evidence documents were shared as a single low-resolution photomontage, making them difficult to distinguish. However, there are clearly several passport scans, several other ID documents, some type of account application, and a credit card scan.
At least one of the identity documents appears to be linked to a member of Engedi’s staff.
Engedi offers a range of services, including group skills programmes, therapy support and coordination, NDIS plan management and individual support, and has been operating since 1985. The not-for-profit organization operates from two locations in Queensland: Engedi Support Services. in Beaconsfield and Engedi Therapy Hub in Mount Pleasant.
Rhsyida, first observed in July 2023, has claimed 14 victims so far this month, including The Washington Times and the Sumter County Sheriff’s Office in the United States. The gang has claimed responsibility for 139 recorded attacks since its creation, the vast majority of them in the United States.
