Group
Rhysida
Discovered
2026-10-29 14:14 UTC
Est. attack date
2026-10-29
Sector
Agriculture and Food Production
Education
Energy & Utilities
Financial Services
Government & Defense
Healthcare
Hospitality
Manufacturing
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
INTAX, Inc. Complete file server of INTAX, Inc. (Lexington, KY, USA) - a property-tax compliance and bill-pay firm.892,867 files, 1.27 TBClient tax returns: 649,905 PDFs. Clients include AARP, ADT, Pilot Travel Centers, Wendy's, Valvoline, Zions, Raytheon (~100 companies).Client accounting: 100+ QuickBooks company files � full ledgers, banks, payroll.Money: bank account + routing numbers, $910,000 wire form, signed W-9, proof the firm opens dedicated accounts and pays client taxes (~$73.6M/yr moved).Identity data: US passports of the owner and employees, driver license, birth certificate, W-2s with SSNs, IRS filings 2025�2026, medical insurance cards.60+ cleartext password files: US government tax portals + the firm's own QuickBooks.24,000+ emails, personal employee folders, lawsuit records, owner exit/sale planning. More
Leak Screenshot:
Other recent victims
Same group: Rhysida
-
Noelker and Hull
2026-10-28
-
Machelen (Belgium)
2026-10-27
-
MISC Group
2026-10-26
Same sector: Financial Services
-
National Association of Credit Management
2026-10-29
-
xspringcapital.com
2026-10-29
-
Money Concepts Capital
2026-10-27
Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.