Skaff Group listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Lebanon
• Announcement date: October 3, 2026

Rhysida ransomware group targets Skaff Group

The Rhysida ransomware group has listed the Lebanon-based company Skaff Group on its leak site. According to the announcement made on October 3, 2026, the threat actors claim to have successfully infiltrated the organization's network and exfiltrated a significant volume of sensitive information.

The group alleges that the breach resulted in the theft of approximately 268 GB of data. This data is said to consist of 139,377 individual files. The threat actor claims that the stolen information includes a variety of sensitive records, ranging from human resources documentation to critical commercial and financial files.

Details of the alleged data breach

The information claimed to be stolen by the Rhysida group covers a wide spectrum of organizational and personal data. The threat actor asserts that the breach includes sensitive documents that could impact both the company's operations and the private lives of its staff. The specific types of data mentioned in the leak site announcement include:

• Human resources files
• Lebanese national ID cards
• Passports
• Civil-status extracts
• Byblos Bank and Cedrus Bank account details
• Payroll records
• Family photos
• Price lists
• Customs documents

The breadth of this alleged data set suggests a deep level of access to the organization's internal systems, touching upon administrative, financial, and logistical departments.

About Skaff Group

Skaff Group is a company based in Lebanon that specializes in the production and supply of decorative fabrics and home textiles. The organization operates within the interior design and decoration sector, providing materials used in home and commercial styling.

Potential impact and security implications

This incident carries several significant risks for the organization and its stakeholders. The alleged exposure of highly personal information, such as national ID cards, passports, and civil-status extracts, significantly increases the risk of identity theft for the affected employees. Furthermore, the presence of family photos and payroll records alongside identity documents makes employees potential targets for highly personalized and sophisticated phishing attacks.

From a corporate perspective, the alleged leak of bank account details for Byblos Bank and Cedrus Bank, combined with salary information, could create secondary risks for the organization's financial operations. Additionally, the publication of commercial documents and price lists may cause direct damage to the organization's commercial reputation. Given the Rhysida group's known use of double-extortion methods—whereby stolen data is threatened to be leaked to pressure victims into paying—the public release of this information can be devastating to a company's market standing.

The organization may also face legal obligations and regulatory scrutiny under the data protection regulations applicable in Lebanon. While public information regarding the specific operations of the Rhysida group remains limited, the impact of such breaches highlights the ongoing threat posed by ransomware actors. In general, organizations facing such threats often focus on strengthening network segmentation, implementing robust multi-factor authentication, and maintaining comprehensive employee training to mitigate the risk of initial infiltration and subsequent data exfiltration.