Sibbalds listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: October 16, 2025

The Rhysida ransomware group has listed the United Kingdom-based accounting firm Sibbalds on its dedicated leak site. According to the announcement made on October 16, 2025, the threat actor group claims to have successfully breached the organization's systems and is threatening to release the acquired data to the public.

The claimed attack and extortion attempt

The incident involves a claim by the Rhysida ransomware group that they have gained unauthorized access to the internal systems of Sibbalds. The announcement, which was officially posted on the group's leak platform on October 16, 2025, serves as a notification of the breach. The group has stated that they hold data belonging to the organization and are using the threat of public disclosure as leverage.

Ransomware groups often employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The primary goal is to pressure the victim into paying a ransom by threatening to leak the stolen data on public forums or specialized leak sites. This method significantly increases the pressure on an organization, as the threat of data exposure remains even if the victim can restore systems from backups.

Data involved in the leak

While the specific volume of data and the total number of files have not been disclosed by the group, samples shared in screenshots indicate that the stolen information is highly sensitive. The leaked content appears to include various documents related to financial and tax matters. Specifically, the following types of data are identified as being involved in the claim:

• Tax returns
• Financial documents
• HMRC correspondence

The presence of documents related to His Majesty's Revenue and Customs (HMRC) suggests that the breach may involve official tax-related communications and sensitive fiscal records. The exposure of such documentation typically poses significant risks to the privacy of the individuals and businesses represented in those files.

About Sibbalds

Sibbalds is a chartered accountancy firm based in Derby, United Kingdom. The firm provides a wide range of accounting and financial advisory services to owner-managed businesses located across England.

Impact and security implications

The potential exposure of this data poses a significant risk to the clients of the firm, as it involves sensitive financial information. For a professional services firm operating within the United Kingdom, such an incident may have serious implications regarding data protection obligations under the UK GDPR. The loss of confidentiality regarding client financial records can lead to secondary risks, including identity theft and highly targeted phishing attacks against the affected parties.

Given the double-extortion methodology utilized by the Rhysida group, the organization may face both operational disruption and significant reputational damage. The public release of client data can create long-term security risks for the individuals involved, as their private financial histories may remain available in the public domain indefinitely.

In the professional services sector, organizations often implement various defensive measures to mitigate these risks. These include robust access controls, multi-factor authentication (MFA), and continuous monitoring of network traffic to detect unauthorized access. Furthermore, maintaining strict data encryption protocols for data at rest and in transit can help protect sensitive information even if a perimeter is breached. Regular security audits and employee training regarding phishing attempts are also standard practices used to defend against the initial stages of a ransomware attack.