MDB listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: United States
• Sector: Technology
• Announcement date: April 26, 2025

Rhysida ransomware group claims attack on MDB

The Rhysida ransomware group has officially listed the organization MDB on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully obtained data belonging to the target organization. This development marks a new addition to the group's public list of victims, signaling a potential data breach involving the technology firm.

The announcement regarding MDB was posted on the group's leak site on April 26, 2025. While the threat actor has publicly declared that they have acquired information belonging to the organization, the listing remains sparse in terms of specific technical details. At this stage, the group has not disclosed the total volume of data stolen, nor have they provided a specific count of the files involved in the incident.

Details of the claimed breach

In the listing provided by the Rhysida group, there is a notable absence of specific information regarding the nature of the data allegedly leaked. The group has not provided any screenshots or documentation to substantiate their claims or to demonstrate the specific types of files they have acquired. Furthermore, the announcement does not include any information regarding a ransom demand, leaving the financial implications of the claim unknown at this time.

The listing names no data types or specific categories of information that have been compromised.

About MDB

MDB Srl is an engineering and technology company that was founded in 1977 by Mario Di Biase. Based in the Abruzzo region of Italy, the company has established a long-standing presence in the industry. MDB specializes in the production of specialized machinery and remote-controlled tracked vehicles.

Potential risks and implications

Given the established methods of the Rhysida group, there is a possibility that the allegedly leaked data contains sensitive information belonging to customers or employees. Such a situation could lead to significant compliance issues under the data protection regulations in the region where the organization operates. The alleged leak may negatively impact the organization's reputation and could potentially facilitate secondary risks, such as targeted phishing attacks or identity theft.

Because this group utilizes a double extortion method, the risk of the data being published or sold on the dark web may persist. In double extortion schemes, attackers not only encrypt an organization's data but also threaten to leak sensitive information to pressure the victim into paying the ransom. This dual threat increases the pressure on organizations to comply with demands to avoid public exposure.

For organizations operating within the technology and engineering sectors, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security audits to identify vulnerabilities. As public information regarding the Rhysida group remains limited, organizations must remain vigilant against the evolving tactics used by such threat actors.