Government of Peru targeted by Rhysida ransomware group

• Ransomware group: Rhysida
• Country: Peru
• Sector: Government & Defense
• Announcement date: May 1, 2025

Rhysida claims to have breached the Government of Peru

The Rhysida ransomware group has officially listed the Government of Peru on its dedicated leak site. In a recent announcement, the group claimed to have successfully gained access to the institution's data, specifically referencing the gob.pe domain. This domain serves as the primary digital platform for the Peruvian State, acting as a centralized portal for various public services.

The group's announcement suggests a high level of intent regarding the stolen information, as they have indicated that the data may be either published publicly or sold to other malicious actors on the dark web. This type of threat is common among modern ransomware operations, where the goal is to maximize leverage over the victim through the threat of exposure.

Details regarding the alleged data breach

Despite the claims made by the Rhysida group, specific details regarding the nature of the alleged breach remain limited. At this time, no information has been provided regarding the specific types of data that may have been compromised. Furthermore, the group has not released any screenshots to substantiate their claims of having access to the internal systems or files of the organization.

The listing currently names no specific data types or individual files that have been targeted or exfiltrated.

The organization profile

The target of this alleged attack is Gob.pe, which serves as the official digital platform of the Government of Peru. This platform operates as a centralized portal designed to provide citizens with access to various state services. It represents the primary government initiative aimed at consolidating public services into a single, accessible digital environment for the population.

Analysis and potential implications

This situation suggests that a security vulnerability may have occurred within the digital infrastructure of the institution. When a major government entity is targeted, the potential consequences can be significant. If the leaked data were to include sensitive information belonging to public personnel or citizens, it could create substantial risks, including identity theft and the facilitation of targeted phishing attacks against individuals.

Furthermore, such leaks targeting high-profile government institutions can lead to widespread concerns regarding the overall reliability and security of public digital services. The ability of a state to protect its citizens' information is fundamental to the trust placed in digital governance.

Risk assessment and defensive considerations

Given the established history and past activities of the Rhysida group, it is assessed that the institution may be facing a double-extortion scenario. In a double-extortion model, attackers do not merely encrypt an organization's systems to demand a ransom for decryption; they also steal sensitive data and threaten to leak it publicly to increase the pressure on the victim to pay.

In response to such threats, organizations typically must initiate data breach notification processes in accordance with relevant legal regulations to ensure transparency and compliance. To defend against such threats, organizations in the government and defense sector often focus on hardening their digital perimeters, implementing robust access controls, and maintaining rigorous monitoring of their network traffic to detect unauthorized exfiltration attempts. Strengthening incident response plans and ensuring regular backups are also critical components of a defensive posture against ransomware-driven data breaches.