Milicic listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Argentina
• Announcement date: April 23, 2025

Rhysida group claims attack on Milicic

The Argentine construction and services company Milicic has been listed on the leak site associated with the Rhysida ransomware group. According to an announcement published by the threat actors on April 23, 2025, the group claims to be in possession of data belonging to the organization. This development follows the group's established pattern of targeting various entities to facilitate their extortion efforts.

The incident was officially announced on the group's leak site on April 23, 2025, which coincides with the date the group claims the attack took place. This type of public listing is a hallmark of modern ransomware operations, where attackers use the threat of data exposure to pressure victims into meeting their demands. Such tactics are often used in conjunction with encryption to maximize the leverage held by the cybercriminals.

Details of the ransom demand and claims

The Rhysida group has issued a specific demand in relation to the alleged breach. The group is demanding a ransom of 10 BTC for the return or non-disclosure of the data they claim to have stolen. In their announcement, the attackers stated that the stolen data would be offered for sale to a single buyer and emphasized that the information would not be resold to multiple parties.

Ransomware groups often employ a method known as double extortion. In this scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. This allows them to threaten the victim with the public release of confidential data if the ransom is not paid. This dual-threat approach increases the pressure on the target organization, as the risk shifts from mere operational downtime to significant legal and reputational damage.

Information regarding the alleged leaked data

Regarding the specific content of the data that the Rhysida group claims to have acquired, no specific details have been provided in the announcement. While the exact nature of the files remains unconfirmed, it is considered that the information may contain sensitive details related to the organization's construction and infrastructure projects.

The listing does not name any specific data types or categories of information that have been compromised. Consequently, the full scope of the data breach remains unclear at this time. The lack of transparency from the threat actor regarding the specific files stolen is common, as it maintains a level of uncertainty that can be used as a psychological tool during negotiations.

About Milicic

Milicic is an Argentine construction and services company with over 50 years of experience specializing in large-scale projects. The company executes infrastructure projects that contribute to the development of various productive sectors in the country.

Potential impacts and organizational risks

The actions taken by the Rhysida group may have significant consequences for Milicic. Such an attack can negatively impact the organization's operational continuity and its commercial reputation. If the leaked data is found to include information pertaining to employees or customers, it may trigger legal processes under the data protection regulations of Argentina.

Beyond the immediate impact on the company, there are several secondary risks associated with this type of breach. The leaked information could potentially be utilized in future phishing attacks or for corporate espionage activities. Furthermore, because of the double-extortion method employed by the group, the organization's supply chain partners may also be at risk if the data is eventually published.

To mitigate such risks, organizations in the construction and infrastructure sectors often focus on strengthening their defensive posture. This typically involves implementing robust data protection measures, enhancing monitoring capabilities, and ensuring that backup systems are isolated from the main network. Maintaining a clear incident response plan and ensuring compliance with regional data protection laws are also critical components of a comprehensive cybersecurity strategy.