Gemini Group listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: United States
• Sector: Professional Services
• Announcement date: October 28, 2025

The Rhysida ransomware group has officially listed the Gemini Group on its dedicated leak site. According to the announcement made on October 28, 2025, the threat actor group claims to have compromised data belonging to the organization, marking a new incident for the group's ongoing activities.

The claimed attack

The Rhysida ransomware group claims to have successfully executed an attack against Gemini Group, resulting in the theft of data. By listing the organization on its leak site, the group is utilizing a common tactic used by modern ransomware operators to exert pressure on victims. This specific group, which first emerged in 2023, is recognized as a double-extortion threat actor. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information to use as leverage for extortion.

Rhysida has a documented history of targeting various sectors, including healthcare, education, and public sector organizations. This latest claim against Gemini Group follows their established pattern of targeting entities to demand ransoms in exchange for not releasing stolen information. The announcement identifies the victim as operating within the professional services sector.

Data involved in the incident

At this stage of the incident, there is no information provided regarding the nature of the leaked or threatened data. The listing does not include any screenshots or specific details regarding the content of the files allegedly stolen by the group. Furthermore, no information has been provided regarding the total volume of data or the specific number of files involved in the breach.

Details of the breach

• No data types have been named in the listing.

About Gemini Group

Gemini Group is a manufacturing company based in the United States. The firm specializes in the design and production of complex metal components. Their core business involves providing comprehensive manufacturing solutions, including metal forming, welding, and assembly, specifically tailored for the automotive industry.

Risk assessment and implications

The listing by the Rhysida group may pose significant operational and reputational risks to Gemini Group due to the alleged data breach. Because the organization is based in the United States, the incident may trigger various state-level data privacy laws and specific notification requirements, depending on the actual nature of the compromised data once it is identified.

Due to the double-extortion method employed by Rhysida, the potential publication or sale of the data could lead to severe secondary risks. These include the possibility of identity theft and the execution of targeted phishing attacks aimed at the organization's customers and employees. When attackers possess sensitive information, they can craft highly convincing social engineering campaigns that exploit the stolen context to deceive individuals.

Given the group's past activities and their methodology, the possibility of further data leaks should be considered if a ransom demand is not met. In the broader context of cybersecurity, organizations facing such threats often focus on robust backup strategies, network segmentation, and continuous monitoring to mitigate the impact of exfiltration and encryption. For companies in the manufacturing and professional services sectors, protecting intellectual property and supply chain data is a critical component of maintaining operational integrity and trust with automotive industry partners.