J ransomware group lists rhodar.co.uk on its leak site

• Ransomware group: J
• Country: United Kingdom
• Announcement date: June 21, 2025

The threat actor group J claims to have stolen data from Rhodar

The threat actor group known as J has listed data allegedly belonging to the United Kingdom-based company Rhodar on their dedicated leak site. According to the announcement made on June 21, 2025, the group claims to have successfully compromised the organization's systems, leading to a significant data breach. The group asserts that they have obtained a substantial amount of information, specifically claiming to possess a dataset totaling 93 GB in size. This claim follows an alleged attack date of June 10, 2025.

In such cyberattack scenarios, threat actors often utilize leak sites to apply pressure on their victims. This tactic is a hallmark of double extortion, where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to threaten public disclosure. By publishing a listing on a leak site, the group aims to damage the reputation of the target and coerce them into paying a ransom to prevent the data from being released to the public or sold to competitors.

The group has indicated that they are open to negotiations regarding the data. Specifically, the threat actor is requesting that any interested parties contact them via the Tox messaging platform to discuss the purchase of the stolen information. No specific ransom demand has been disclosed in the public announcement.

Details of the alleged data breach

The announcement made by the group J specifies that the stolen information is quite diverse and covers sensitive areas of the company's operations. The group claims that the 93 GB dataset contains a variety of critical documents that could be highly damaging if released. According to the listing, the following types of data are included in the breach:

• Financial records
• Employee data
• Balance sheets
• Cash flow data
• ID card details

The presence of such varied data types suggests a deep level of access into the organization's internal filing systems and administrative databases. When identity card details and employee information are involved, the breach moves beyond simple corporate espionage and enters the realm of personal privacy violations, which can have long-lasting consequences for the individuals involved.

About Rhodar

Rhodar is a company based in the United Kingdom that operates within the construction and environmental services sector. The organization specializes in several critical areas, including asbestos removal, demolition, and the management of hazardous materials. They are known for providing comprehensive solutions for various industrial and commercial projects, making them a specialized player in the management of high-risk environmental services.

Risk assessment and organizational implications

The alleged exposure of both employee and financial information carries significant risks. For the company's staff and stakeholders, the theft of ID card details and personal employee data increases the risk of identity theft and makes them targets for highly specific, targeted phishing attacks. Such attacks often leverage the stolen information to appear legitimate, making it harder for employees to detect fraudulent communications.

Furthermore, because Rhodar operates within the United Kingdom, this incident may necessitate a formal assessment under the UK GDPR (General Data Protection Regulation) regarding the company's data protection obligations. The nature of the leaked data, which includes financial records and balance sheets, could also pose secondary risks related to commercial competition or the security of the company's supply chain. In the hazardous material management sector, maintaining the integrity of business processes is vital for safety and regulatory compliance.

While the group J has made these claims, it is important to note that public information regarding this group remains limited, and no definitive conclusions can be drawn regarding their specific methods or motivations. Additionally, the accuracy and the actual scope of the data mentioned in the leak site announcement have not yet been verified by any independent sources. Organizations facing similar threats are generally advised to implement robust defensive measures, such as multi-factor authentication, regular offline backups, and continuous monitoring of network traffic to detect unauthorized access early.