Rhysida ransomware group claims data breach against Charles E. Tabor AAL LLC

• Ransomware group: Rhysida
• Country: United States
• Announcement date: October 11, 2026

Rhysida claims data breach against Charles E. Tabor AAL LLC

The Rhysida ransomware group has published a claim on its leak site involving the United States-based organization Charles E. Tabor AAL LLC. According to the announcement, the group has accessed and listed a significant volume of data belonging to the firm, alleging that the breach was discovered on October 11, 2026.

The group claims to have compromised approximately 96,456 files, totaling roughly 114.5 GB of data. This announcement is categorized as a data leak, a common tactic used by modern ransomware operators to pressure victims into paying ransoms through the threat of public exposure.

Details of the alleged data theft

The Rhysida group alleges that the stolen information includes a wide array of sensitive documents and personal records. By leaking this data, the group appears to be employing a double extortion strategy. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to threaten its public release, thereby increasing the pressure on the victim to comply with ransom demands.

The specific types of data claimed to be included in the leak are highly sensitive and include:

• Personally identifiable information (PII)
• Medical records
• Financial data
• Tax forms
• Identity documents

The group's claims suggest that the breach involves a variety of critical documents, such as client databases, hospital and insurance scans, HIPAA authorization forms, driver's licenses and IDs of minors, tax forms containing SSNs, death certificates, and signed settlement checks.

About Charles E. Tabor AAL LLC

Charles E. Tabor AAL LLC is a law firm based in the United States, specifically located in Louisiana. The firm provides legal services with a specialization in personal injury and settlement cases. Due to the nature of its legal practice, the firm handles a high volume of sensitive client information, including medical and financial documentation related to legal settlements.

Potential risks and organizational implications

The nature of the allegedly leaked data carries significant risks for the clients of the firm. The presence of signed checks and documents containing Social Security Numbers (SSNs) could facilitate secondary attacks, potentially leading to direct financial losses for the individuals involved. Furthermore, the exposure of health data protected under the Health Insurance Portability and Accountability Act (HIPAA) could result in serious legal consequences for the firm.

The exposure of such sensitive information, including identity documents and PII, increases the risk of identity theft and fraud for the firm's clients. Additionally, the Rhysida group's use of double extortion methods may create long-term risks, such as targeted phishing attacks directed at the affected individuals following the data leak.

For organizations operating in the legal and medical sectors, such incidents highlight the necessity of robust security measures. Common defensive steps for organizations include implementing strict access controls, maintaining comprehensive data breach notification processes, and ensuring rigorous encryption for sensitive client files. Organizations must also remain vigilant against secondary threats like phishing that often follow a public data leak.