Rhysida Claims SAD’S Interim Data, Including Payroll and Banking Records
Summary
A ransomware.live monitoring post attributes a claim involving SAD’S Interim to Rhysida. The group reportedly listed payroll, banking, identity, and employment records; the post says the claims are unconfirmed.
Key points
- The monitoring post attributes the claim to the Rhysida ransomware group and names French temporary-employment company SAD’S Interim as the victim.
- The post says the claimed data includes BRANIPP ERP SQL backups, payroll records, bank statements, and factoring records.
- Other reportedly listed material includes worker contracts, identity documents, bank details, and national insurance numbers.
- The post gives discovery and publication timestamps of September 8, 2026.
- The author says the claims came from Rhysida and could not be confirmed.
Article Details
- Victim
- SAD’S Interim
- Claim Date
- 2026-09-08
- Encryption Status
- Unknown; the source does not report encryption.
- Exfiltration Status
- Claimed by rhysida; not independently confirmed.
- Exfiltrated Data
- The group’s public claim reportedly included SQL backups of the BRANIPP ERP and payroll database, payroll documents, bank and factoring records, contracts, and workers’ identity and employment documents. The source says it cannot confirm the claim’s accuracy.
- Leak Status
- Listed on rhysida’s public claim site; the source does not establish the authenticity of the data or whether it was published.