Ransomware gang says it hacked NY social services provider Liberty Resources

Ransomware group Rhysida today claimed it hacked Liberty Resources, a human service agency in New York.

A notice posted on Liberty’s website at time of writing states, “We are currently experiencing issues with our phone system,” with a link to instructions on alternative contact methods. Ransomware attacks often affect phone systems.

Rhysida claims to have stolen an undisclosed amount of data from Liberty Resources in the attack. The proof pack appears to show passports scans and other documents. The group is demanding 20 BTC in ransom—worth about $1.2 million at time of writing—in exchange for not reselling stolen data to a third party. The ransom deadline is in seven days from today.

Liberty Resources has not verified Rhysida’s claim. We do not yet know what data was compromised, whether Liberty did/will pay a ransom, or how attackers breached Liberty’s network.

Comparitech contacted Liberty Resources for comment and will update this article if it responds.

Who is Rhysida?

Rhysida is thought to have ties to the ransomware group Vice Society and first surfaced in May 2023. Since then, Comparitech researchers logged 52 confirmed ransomware attacks claimed by Rhysida, affecting nearly 3.5 million records. Its average ransom demand is just north of $1 million.

Rhysida is the group behind attacks on the city of Columbus, OH; New Jersey City University; Sumter County Sheriff’s Office; and New Mexico Law Offices of the Public Defender.

In 2024 so far, we tracked 11 confirmed ransomware attacks claimed by Rhysida, and 36 unconfirmed attacks.

Ransomware attacks on US healthcare

Hospitals, clinics, and other healthcare-related organizations are frequent targets for ransomware attacks. In addition to data theft, ransomware can disrupt key systems used for payments, appointments, medical records, and more. Hospitals and clinics might be forced to cancel appointments and divert patients elsewhere, or resort to pen and paper until systems are restored.

In 2024, Comparitech recorded 55 confirmed ransomware attacks on US healthcare entities, affecting 6.3 million records. Another 103 attacks have yet to be confirmed. The average ransom is $825,000.

Rhysida has claimed attacks on several healthcare targets including Prospect Medical Holdings, Singing River Health System, Ann & Robert H. Lurie Children’s Hospital of Chicago, and Bayhealth Medical Center.

About Liberty Resources

Liberty Resources is a non-profit behavioral health and social services agency based in Syracuse, New York. Its services pertain to behavioral health, physical health, disability services, early childhood development, and child and family care. The company operates 15 locations in New York and one in Corpus Christi, Texas. According to its LinkedIn profile, it employs more than 900 people and serves about 11,000 patients.