KISS FM listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Spain
• Sector: Technology
• Announcement date: November 5, 2025

The radio station KISS FM has been listed on the leak site associated with the Rhysida ransomware group. According to an announcement made by the threat actor, the organization is the target of a data leak operation. This development follows the group's pattern of claiming responsibility for unauthorized access to organizational data.

The claimed attack event

On November 5, 2025, the Rhysida group published a data leak announcement specifically targeting KISS FM. In this announcement, the group claims to have successfully obtained data belonging to the organization. While the group has made this public claim, the announcement did not include specific details regarding a ransom demand or the total size of the data allegedly stolen during the incident.

Ransomware groups often use leak sites to pressure victims into paying ransoms by threatening to release sensitive information. These platforms serve as a public stage for the threat actors to demonstrate their success. In this particular instance, the group has signaled their involvement, though the specifics of the breach remain limited to the initial claim of data acquisition.

Details regarding the leaked data

At this stage of the incident, the exact nature and content of the leaked information remain unknown. Because no screenshots or specific file samples were provided in the announcement, the specific types of data involved have not been identified. The listing names no data types.

In many cyberattacks, the lack of immediate information regarding the volume or nature of the data can create significant uncertainty for the victim organization. Without a clear understanding of whether the breach involves personal identifiable information, intellectual property, or internal corporate documents, the full scope of the impact remains difficult to assess in the early stages of the disclosure.

About KISS FM

KISS FM is a national radio station based in Spain that broadcasts popular music and entertainment programs. Operating under Mediaset España, the organization provides content through both traditional radio frequencies and digital platforms. As a media entity, the organization relies on various digital and traditional broadcasting infrastructures to maintain its presence in the Spanish market.

Implications and organizational risks

This situation may lead to disruptions in the organization's operational processes and could pose a risk to the confidentiality of corporate data. If a data breach has occurred, legal proceedings may be triggered due to data protection obligations under the GDPR. The potential for regulatory scrutiny increases when organizational data is exposed on public leak sites.

Furthermore, the Rhysida group is known to employ double-extortion tactics. This method involves not only encrypting a victim's systems but also stealing sensitive data to use as leverage for extortion. Because of this tactic, further data exposure or direct extortion attempts may be observed in the future. Organizations facing such threats must remain vigilant against subsequent waves of leaks or secondary ransom demands.

General defensive considerations

While the specific motivations and attack capabilities of the Rhysida group may vary due to limited public information, organizations in the technology and media sectors can take several defensive steps to mitigate such risks. These include:

• Implementing robust encryption for data at rest and in transit to protect confidentiality.
• Maintaining rigorous access controls and multi-factor authentication to prevent unauthorized entry.
• Regularly monitoring networks for unusual activity that might indicate data exfiltration.
• Ensuring comprehensive backup strategies are in place to assist in operational recovery.

The complexity of modern ransomware attacks requires a proactive approach to cybersecurity, particularly for organizations that manage significant digital content and broadcast infrastructure.