Legis listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Colombia
• Sector: Professional Services
• Announcement date: September 23, 2026

Rhysida claims data breach at Legis

The Rhysida ransomware group has listed Legis, a prominent publishing company based in Colombia, on its dedicated leak site. According to the announcement made on September 23, 2026, the threat actor group claims to have successfully compromised the organization and exfiltrated various datasets. This development follows the group's established pattern of targeting high-value organizations to facilitate their extortion efforts.

The incident was officially announced on the group's leak site on September 23, 2026, which coincides with the date the group claims the attack took place. While the group has claimed responsibility for the breach, the specific details regarding the volume of data stolen and the exact ransom demand have not been disclosed in the announcement. This lack of information regarding the scale of the theft is common in many ransomware incidents until the attackers decide to escalate their pressure on the victim.

This action appears to be a calculated part of the group's double-extortion strategy. In a double-extortion scenario, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information. The threat of leaking this stolen data on a public platform serves as a powerful tool to exert psychological and reputational pressure on the victim, forcing them toward compliance with ransom demands to prevent the public exposure of confidential files.

Claimed data and affected information

The Rhysida group asserts that it has obtained a wide array of sensitive information belonging to Legis. The group claims to possess legal and business information resources, alongside various financial and customer-related files. The breadth of the alleged theft suggests a deep penetration into the organization's digital infrastructure.

The specific types of data mentioned in the claim include a diverse range of sensitive records, such as:

• SQL databases
• PST/OST files
• Constitutional action records
• Identity card copies
• Environmental sanction proceedings
• Pension authority dispute records
• Trademark dispute documents
• Data transfer agreements
• Litigation logs
• Contract matrices
• Shareholder registers
• Financial reports
• Customer databases

Based on the nature of these files, the breach potentially impacts several critical categories of information. The affected data types include personal data, identity information, financial data, customer databases, and contract records. The exposure of such a variety of data types indicates that the breach could have far-reaching consequences for the organization and the individuals whose information is contained within those files.

Organization profile

Legis is a well-established publishing company that provides specialized legal and business information resources across Latin America. Founded over 60 years ago and headquartered in Colombia, the company offers legal content and data services to professionals throughout the region.

Risk assessment and organizational implications

The alleged exfiltration of highly sensitive information, such as identity card copies and financial records, poses a significant risk of identity theft for both employees and third parties involved with the organization. Furthermore, the exposure of customer databases could compromise the confidentiality of business relationships with major entities, such as Ecopetrol and Halliburton, which could potentially facilitate supply chain attacks against these larger organizations.

Given that Legis operates extensively throughout Latin America, the company may face significant legal repercussions and administrative fines under regional data protection regulations following such a breach. The sensitive nature of the legal and business resources they provide makes them a high-value target for sophisticated threat actors.

Considering Rhysida's established double-extortion tactics since 2023, the leaked data is likely to be utilized in future targeted phishing campaigns. Attackers often use stolen information to craft highly convincing social engineering attacks, making it much harder for employees or clients to distinguish between legitimate communications and fraudulent ones.

To mitigate such risks, organizations in the professional services and publishing sectors should prioritize robust security frameworks. This includes implementing strict access controls, maintaining regular offline backups, and employing continuous monitoring to detect unauthorized data movement. Furthermore, organizations should focus on data encryption at rest and in transit to minimize the impact of a potential exfiltration event.