Charles E. Tabor AAL LLC (US) reported ransomware activity by the threat actor rhysida affecting 96,456 files (~114.5 GB) and producing settlement-related artifacts across multiple 2026 checks. The incident involved comprehensive exposure of consolidated client PII, including medical scans and HIPAA authorizations, minors’ IDs and driver’s licenses, tax forms with SSNs, and Louisiana death certificates, with settlement check images suitable for check fraud. #UnitedStates
Incident Details
- Victim: Charles E. Tabor AAL LLC
- Sector: Other
- Country: US
- Actor: rhysida
- Source: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/archive.php?company=282
- Discovered: 2026-10-11T06:31:57.130852+00:00
- Published: 2026-10-11T06:31:08.095603+00:00
Information
- 96,456 files totaling approximately 114.5 GB were exposed.
- Complete client database with PII across multiple years, consolidated in a single file.
- Hospital and insurance scans spanning dozens of cases.
- Medical scans and HIPAA authorization forms.
- Driver’s licenses and IDs belonging to minor victims.
- Tax forms containing Social Security numbers.
- A Louisiana state death certificate identified as “plaintiff’s exhibit D7.”
- Settlement artifacts including endorsement authorizations, signed releases, and HIPAA authorizations.
- Scans of large settlement checks with signatures and MICR lines, creating a potential toolkit for check fraud.
- Included settlement checks such as $600,000, $587,500, $350,000, and $50,000.
Disclaimer: This post is based on public claims made by the ransomware group "rhysida". I cannot confirm the accuracy of the information. However, I would be happy to share any official statement from the affected organization to provide clarification.