Coastal Pacific Xpress listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Canada
• Sector: Transportation
• Announcement date: September 10, 2025

Rhysida claims data breach at Coastal Pacific Xpress

The Rhysida ransomware group has reportedly listed the Canadian transportation company Coastal Pacific Xpress on its dedicated leak site. According to an announcement published by the threat actor group, the organization has been targeted in a cyberattack, with the group alleging that they have successfully obtained the institution's data.

This announcement, which appeared on September 10, 2025, marks a significant development in the ongoing threat landscape facing the logistics sector. While the group has officially claimed responsibility for the incident and the acquisition of data, it is important to note that at this stage, the listing remains an allegation by the ransomware group. No independent verification has been provided to confirm the breach or the validity of the group's claims.

Details of the alleged incident

The event was officially announced on September 10, 2025, the same day the group claims the attack took place. In their public statement on the leak site, the Rhysida group asserted that they have gained access to the institution's internal information. However, the group has not provided any concrete evidence to support these claims, such as screenshots of the stolen files or specific data samples that would verify the extent of the intrusion.

Ransomware groups often use leak sites to apply pressure on their victims through public exposure. This tactic is a core component of modern cyber extortion. By listing an organization, the attackers aim to damage the victim's reputation and create urgency for the payment of a ransom. In this specific case, the lack of supporting documentation makes it difficult to assess the immediate technical impact of the alleged intrusion.

Information regarding the leaked data

At this time, there is no information regarding the nature of the leaked or threatened data. The announcement does not specify the types of files, the volume of data, or the specific databases that were allegedly compromised. Furthermore, no screenshots have been made available to the public to illustrate the content of the alleged theft.

• The listing names no specific data types.

The absence of detailed information regarding the data content is a common occurrence in the early stages of a ransomware leak site announcement. Without specific details, it remains unknown whether the data involves sensitive corporate information, employee records, or client details.

Organization profile

Coastal Pacific Xpress (CPX) is a Canada-based logistics and transportation company. The company specializes in refrigerated transportation and supply chain solutions, playing a role in the movement of temperature-sensitive goods.

Potential impact and industry considerations

This situation may lead to disruptions in the institution's operational processes and potential data privacy breaches. Given the Rhysida group's known use of the double-extortion method, the allegedly leaked data may pose secondary risks. Double extortion is a technique where attackers not only encrypt a victim's data to disrupt operations but also steal sensitive information to threaten the victim with public disclosure if a ransom is not paid.

Because of this method, the organization's customers and employees could be at risk of identity theft or targeted phishing attacks if sensitive personal information was indeed compromised. Furthermore, under Canada's PIPEDA regulations, the institution may be required to fulfill data breach notification obligations to ensure compliance with privacy laws.

In the transportation and logistics sector, such incidents can have cascading effects on supply chain reliability. Organizations in this sector often prioritize robust cybersecurity frameworks to protect sensitive logistical data and maintain operational continuity. Common defensive steps for organizations facing such threats include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access through phishing.

Public information regarding the Rhysida group remains limited, making it difficult to attribute specific tactics, techniques, and procedures to the group beyond their use of leak sites for extortion purposes.