Loading story…
The Maryland Transit Administration (MTA) experienced a significant cyberattack that resulted in the theft of sensitive data and disruption of certain services. The incident came to light when Maryland officials reported that several state departments, including the MTA, were affected by a cyberattack that impacted systems used to coordinate transportation for disabled individuals. The MTA confirmed that data was stolen during the attack, but did not disclose the number of affected individuals or the specific types of data compromised, citing the sensitivity of the ongoing investigation. The Rhysida ransomware gang, known for targeting government entities, claimed responsibility for the attack and demanded a ransom of 30 bitcoin, equivalent to approximately $3.3 to $3.4 million, giving the MTA seven days to comply. Rhysida published samples of the stolen data, which reportedly included passports, driver’s licenses, contracts, and other documents. The attack did not affect the MTA’s core transportation services such as bus lines, subways, and light rail, but it did disrupt real-time information systems and tools used for the Mobility service, which provides specialized transportation for people with disabilities. The Mobility service was restored through an interim call system on August 29, but the MTA has not specified the duration of the disruption. The Maryland Department of Information Technology is collaborating with cybersecurity experts and law enforcement agencies to investigate the breach and mitigate its impact. Analysis of Rhysida’s dark web post indicated the presence of internal financial and budget documents, though it is unclear if private personal details were included. Rhysida’s operation has compromised over 220 organizations globally, including high-profile victims such as the Seattle-Tacoma International Airport and the Anne & Robert H. Lurie Children's Hospital. The MTA has not confirmed whether the breach claimed by Rhysida is the same as the one it reported, but the timing and details strongly suggest a connection. The incident highlights the ongoing threat posed by ransomware groups to critical infrastructure and government services. The MTA has not indicated whether it intends to pay the ransom or negotiate with the attackers. The breach underscores the importance of robust cybersecurity measures and incident response planning for public sector organizations. The investigation is ongoing, and further details about the scope of the data loss and the attackers’ methods may emerge as authorities continue their work.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
MDOT said that some systems within its Transit Administration were affected by a cyberattack. The agency did not confirm whether the incident it acknowledged was the same one claimed by Rhysida.
The Rhysida ransomware group posted claims that it had stolen data from the Maryland Department of Transportation's Transit Administration, alleging the haul included sensitive documents such as IDs, passports, and background checks. The gang demanded about $3.3 million to prevent release of the data.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Richmond Behavioral Health Authority (RBHA) and MedStar Health, two major healthcare providers in the Mid-Atlantic region, have disclosed significant ransomware incidents resulting in the exposure of sensitive patient data. RBHA reported that hackers gained unauthorized access to its systems on September 29, 2025, deploying ransomware that encrypted files containing personal and protected health information for up to 113,232 individuals. Although RBHA stated there was no definitive evidence of patient data being accessed, the organization is notifying all potentially affected individuals and has implemented enhanced security measures, including third-party monitoring and stronger data policies. MedStar Health, which operates hospitals and care sites across Maryland, Virginia, and Washington D.C., confirmed a separate ransomware attack attributed to the Rhysida group, which claims to have exfiltrated 3.7 terabytes of data, including over 7 million pieces of patient information. The breach, occurring between September 12 and 16, 2025, involved the compromise of names, dates of birth, Social Security numbers, and detailed patient care information. MedStar has begun notifying affected patients and is offering complimentary identity monitoring services to those whose most sensitive data was exposed. Both incidents highlight the ongoing threat of ransomware to healthcare organizations and the significant risks to patient privacy and data security.
Jun 29, 2026
Cookeville Regional Medical Center in Tennessee disclosed that a ransomware attack tied to the **Rhysida** gang exposed the personal, financial, and protected health information of **337,917 individuals**. The hospital said an unauthorized party accessed its network between **July 11 and July 14, 2025**, and a forensic investigation later determined that files may have been viewed or stolen during that period. Exposed data varied by individual and could include names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial account details, medical information, medical record numbers, and health insurance information. Rhysida claimed responsibility for the intrusion, saying it exfiltrated about **538 GB** of data and later listed the medical center on its dark web leak site, where it said **70%** of the data had been leaked. The breach was initially reported to HHS with a placeholder figure before a full file review was completed in March 2026, after which the hospital began broader notifications. Cookeville Regional said it has not found evidence of misuse so far, urged affected people to monitor accounts and explanation-of-benefits statements, and offered **12 months** of credit monitoring and identity theft protection.
Jun 29, 2026
The **Rhysida** ransomware operation has intensified its focus on healthcare, with reporting and government guidance describing an expanding threat that has hit organizations across Western Europe, the Americas, and Australia. U.S. health-sector alerts and vendor research say the group has targeted education, government, manufacturing, technology, managed service providers, and increasingly **healthcare and public health** entities. Researchers have also linked Rhysida to tactics associated with the defunct **Vice Society** operation, while earlier incidents included the leak of stolen documents from the Chilean Army and suspected involvement in disruptive attacks on medical providers. Security reporting says Rhysida commonly gains initial access through **phishing** and then uses tools such as **Cobalt Strike** and **PowerShell** to disable defenses, delete shadow copies, alter RDP settings, and deploy ransomware. In a newly reported healthcare case, **SIA Medical Centre** was listed as a victim, with the attackers claiming theft of roughly **20,000 patient medical records** along with staff identity documents, plaintext credentials, HR files, and legal and financial records. The allegedly exposed data included names, dates of birth, Medicare numbers, clinical notes, insurance files, passports, driver’s licenses, and login credentials, underscoring the group’s dual risk of operational disruption and large-scale sensitive data exposure in the health sector.
Aug 15, 2026