[RHYSIDA] – Ransomware Victim: MPA Pharma

Verification alert Listings attributed to RHYSIDA have been reported as including unverified or fabricated victim claims. Treat this post as unconfirmed until corroborated with independent evidence. See further information here: BankInfoSecurity

See further information here: BankInfoSecurity

NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the RHYSIDA Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

On September 18, 2026, the ransomware group Rhysida listed MPA Pharma, an internationally active pharmaceutical import and trading company, on its leak site. No separate compromise date is provided, so this date is treated as the post date. The listing presents the incident as a data-leak event involving approximately 2,899,290 files totaling 5.8 TB. The available information does not state that MPA Pharma’s systems were encrypted, and no ransom amount or payment demand is identified. According to the post, the allegedly obtained material includes accounting records, database and SQL backups, commercial-registration documents, organizational information, credentials, and internal IT artifacts. The listing also claims access to government audit records concerning customs, corporate taxation, social security, and wage taxation, including references to disputed or outstanding amounts. It further describes controlled-substance records involving permits, reconciliations, opioids, cannabis, chemical precursors, and documentation gaps, as well as litigation and arbitration files. The post additionally claims exposure of executive and employee personal information, medical documentation, pharmacovigilance correspondence, rebate and commercial agreements, leadership records, ownership and beneficial-ownership materials, identity documents, passports, and payment-card information. It refers to a report containing password-file information, although no credential values are reproduced in the available description. The leak page contains no screenshots or other images, no downloadable files are indicated, and no specific ransom figure is provided.

On September 18, 2026, the ransomware group Rhysida listed MPA Pharma, an internationally active pharmaceutical import and trading company, on its leak site. No separate compromise date is provided, so this date is treated as the post date. The listing presents the incident as a data-leak event involving approximately 2,899,290 files totaling 5.8 TB. The available information does not state that MPA Pharma’s systems were encrypted, and no ransom amount or payment demand is identified.

According to the post, the allegedly obtained material includes accounting records, database and SQL backups, commercial-registration documents, organizational information, credentials, and internal IT artifacts. The listing also claims access to government audit records concerning customs, corporate taxation, social security, and wage taxation, including references to disputed or outstanding amounts. It further describes controlled-substance records involving permits, reconciliations, opioids, cannabis, chemical precursors, and documentation gaps, as well as litigation and arbitration files.

The post additionally claims exposure of executive and employee personal information, medical documentation, pharmacovigilance correspondence, rebate and commercial agreements, leadership records, ownership and beneficial-ownership materials, identity documents, passports, and payment-card information. It refers to a report containing password-file information, although no credential values are reproduced in the available description. The leak page contains no screenshots or other images, no downloadable files are indicated, and no specific ransom figure is provided.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.