Government of Peru Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target public-sector digital infrastructure worldwide, treating government platforms as high-value sources of internal records and operational data. In this environment, listings on criminal leak sites have become a routine signal that an organisation may have suffered unauthorised access and data theft.

On 1 May 2025 the Government of Peru was listed by the rhysida ransomware group. Public detail remains limited: the number of people affected is unknown, and the only description available is that internal files were allegedly exfiltrated in a ransomware attack. The listing itself is a claim by the group and has not been independently confirmed in the available record. Because Gob.pe serves as the Single Digital Platform of the Peruvian State, any compromise of its systems carries potential consequences for citizens and for the continuity of public services.

What happened

According to the reported information, the Government of Peru was named on a rhysida leak site on 1 May 2025. The group claims that internal files were taken during a ransomware attack. No further technical details—such as the initial access method, the precise date of intrusion, the volume of data removed, or whether encryption was also deployed—have been disclosed in the public summary. The number of individuals whose information may have been involved is listed as unknown. At present the incident rests on the group’s assertion that it holds exfiltrated material; independent verification of the claim is not part of the available facts.

Who is rhysida?

Rhysida is a ransomware operation that first appeared in public reporting in mid-2023. The group typically follows a double-extortion model: after gaining access to a network it steals data and then encrypts systems, threatening to publish the stolen material if a ransom is not paid. Rhysida has previously listed victims across education, healthcare, manufacturing and government sectors. It maintains a dedicated leak site where it posts victim names and, in some cases, sample files. Like other ransomware-as-a-service actors, it relies on affiliates who conduct the intrusions while the core group handles negotiation and data publication. Claims made on its site about any particular victim, including the Government of Peru, should be treated as unverified assertions until corroborated by the organisation itself or by independent forensic evidence.

About Government of Peru

The Government of Peru operates Gob.pe, described as the Single Digital Platform of the Peruvian State. Such platforms typically aggregate or link citizen-facing services, internal administrative systems, and repositories of official records. They commonly process identity documents, tax and social-security data, licensing information, and internal correspondence among ministries and agencies. Because these systems sit at the centre of public administration, a breach can affect both the confidentiality of personal and operational data and the availability of services that citizens rely on daily. The consequential nature of the incident therefore stems less from any single data set and more from the platform’s role as a central digital gateway for the Peruvian state.

The information in question

The only data type named in the available facts is “internal files exfiltrated in a ransomware attack.” No inventory of specific file categories, databases or record counts has been released. Organisations of this kind ordinarily hold a mixture of administrative documents, personnel records, citizen-service data and system configuration files. Whether any of those categories were among the material claimed by rhysida remains unconfirmed. Until the Government of Peru or a competent investigative body publishes a verified list of affected data, the precise contents of the alleged exfiltration cannot be stated as fact.

Why it matters

If internal government files have been taken, the practical risks include unauthorised disclosure of personal information belonging to citizens or public employees, potential misuse of that information for fraud or social engineering, and the possibility that operational documents could be exploited to map further attack paths. For the organisation itself, the incident may disrupt digital services, require costly forensic and recovery work, and erode public confidence in the security of state platforms. Because the scale of the exposure is unknown, the full extent of these risks cannot yet be quantified; the absence of confirmed numbers does not eliminate the need for caution among anyone who has interacted with Gob.pe services.

If your data was in this claimed breach

Individuals who have used Peruvian government digital services should monitor official statements for any confirmation of affected data. Practical first steps include reviewing account activity on Gob.pe and related portals, enabling multi-factor authentication where available, and watching for unexpected communications that reference personal details. Consider placing fraud alerts with financial institutions if financial or identity data may have been involved. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets; such a scan does not confirm involvement in this specific incident but can surface earlier exposures that warrant attention.

AICompiled with AI assistance from public sources and published under our editorial standards.