Hollywood Forever Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 03, 2023, Hollywood Forever was listed by the rhysida ransomware group as a victim of a ransomware attack in which internal files were claimed to have been exfiltrated. The number of people affected remains unknown, and public detail on the incident is limited beyond the group's listing and the description of internal files taken during the attack.

The listing matters because Hollywood Forever operates as a full-service funeral home, crematory, cemetery, and cultural events center. Organizations of this kind routinely handle sensitive personal and family information; any confirmed exposure of internal files can create lasting practical risks for those whose data may have been involved.

Inside the incident

Public reporting on the incident is sparse. What is known is that Hollywood Forever appeared on a rhysida-associated listing dated July 03, 2023, with the claim that internal files had been exfiltrated in a ransomware attack. No confirmed figure for the number of people affected has been published. The precise timing of any intrusion, the initial access method, the duration of unauthorized access, and whether systems were encrypted in addition to data theft have not been disclosed in the available facts.

Because the primary public signal is the threat actor's own listing, the scope and success of the claimed exfiltration should be treated as unverified until corroborated by the organization or independent reporting. No further technical indicators, ransom demands, or recovery details appear in the provided record.

The group behind it: rhysida

Rhysida is a ransomware operation that has been publicly documented since 2023. Like many contemporary ransomware groups, it is associated with double-extortion tactics: encrypting victim systems while also stealing data and threatening to publish or sell it if payment is not made. The group typically posts victim names on a dedicated leak site, sometimes accompanied by sample files or countdown timers, as a form of pressure.

Rhysida has been observed targeting a range of sectors, including healthcare, education, government-adjacent entities, and private businesses. Public analyses of its tooling describe relatively straightforward ransomware binaries and affiliate-style operations rather than highly customized zero-day campaigns in every case. Importantly, a listing on a rhysida leak site is a claim by the group; it does not by itself constitute independent confirmation of the full extent of any breach at Hollywood Forever. No specific statements by rhysida about this victim beyond the listing and the reference to internal-file exfiltration are included in the facts.

Who is Hollywood Forever?

Hollywood Forever is a full-service funeral home, crematory, cemetery, and cultural events center located in the heart of Hollywood. It is a well-known landmark that combines traditional cemetery and funeral services with public cultural programming. As a provider of end-of-life services, it sits at the intersection of personal records, family arrangements, and community events.

Organizations in this sector typically maintain records that can include names and contact details of deceased individuals and next of kin, service and interment arrangements, billing and payment information, and internal operational documents. A breach affecting such an entity is consequential because the data involved is often intimate, long-lived, and difficult for affected families to change or revoke. Even when the exact contents of a theft remain unconfirmed, the nature of the business elevates the potential sensitivity of any internal files that may have left its control.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory—such as specific categories of personal data, employee records, financial documents, or client files—has been named in the available record. The number of individuals whose information may be involved is unknown.

Funeral homes, crematories, and cemeteries commonly hold identifying information about the deceased and their families, contact and next-of-kin details, service contracts, payment or insurance-related records, and internal administrative files. Cultural-events operations may also involve attendee or vendor information. None of these categories can be asserted as confirmed contents of the Hollywood Forever incident; they represent only the types of data such an organization would ordinarily process. Exact exposed data types beyond the general description of internal files remain unconfirmed.

The real-world impact

For individuals and families who have used Hollywood Forever's services, the primary risks—if personal data were among the internal files—include unwanted contact, social-engineering attempts that reference real service details, and longer-term exposure of sensitive personal circumstances. Because end-of-life records can contain information that is hard to alter, the window of potential misuse can extend well beyond the initial incident.

For the organization, a ransomware event that includes claimed data theft can disrupt operations, require forensic and recovery work, trigger notification and regulatory obligations where applicable, and damage trust with families and the wider community. Without confirmed counts or a detailed data inventory, the scale of these effects cannot be quantified from public facts alone. The absence of disclosed numbers does not eliminate risk; it simply means the precise impact remains unclear.

Were you affected?

If you or your family have done business with Hollywood Forever, treat the situation cautiously until more definitive information appears. Monitor financial and email accounts for unexpected activity, be skeptical of unsolicited calls or messages that reference funeral or cemetery services, and consider placing fraud alerts if you believe sensitive identifiers may have been involved. Retain any official notices the organization may issue.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it can help you spot credentials or personal details that have appeared elsewhere and take follow-up actions such as password changes and heightened account monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.