Rhysida Claims CRI Electric Data Theft

Summary

A ransomware monitoring record attributes an unverified Rhysida claim against CRI Electric, alleging theft of employee account artifacts, vendor tax forms, payroll, HR/legal correspondence, and financial and certification records.

Key points

• The record names U.S. energy and utilities company CRI Electric as the victim and attributes the claim to Rhysida.
• The claim was discovered and published on August 22, 2026, and is linked to a Rhysida archive.
• Allegedly affected materials include employee federal-account artifacts, such as Login.gov recovery keys and access data for TSP, ID.me, DoD DS Logon, and PIEE.
• Other claimed records include vendor W-9 forms, payroll, privileged HR/legal correspondence, and OSHA-related injury or incident reports with photos.
• The claim also lists public-sector bid pricing, corporate governance documents, QuickBooks financials, and certification records.
• The monitoring post says the claim is unconfirmed; no independent evidence of compromise is provided.

Threat Actors

Industries

Related Articles

• Arctic Wolf’s 2026 Threat Report Finds Remote Access Abuse Behind 65% of Non-BEC Casesgithub.com/jacobdjwilsonRhysida
• Rhysida Claims to Expose 51.3 GB of Reed & Giordano PA Dataransomware.liveRhysida
• AhnLab’s September 2026 Ransomware Report Details Group Activity and Victim Trendsasec.ahnlab.comRhysida
• Rhysida Claims Ransomware Attack on Louisiana Law Firm, Alleging Exposure of 96,456 Filesransomware.liveRhysida
• CYFIRMA Report Finds Sustained Cyber Threats Across Government and Civic Organizationscyfirma.comRhysida