IDS Group Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
IDS Group was listed by the rhysida ransomware group on May 25, 2026, after internal files were exfiltrated in a ransomware attack. The number of people affected has not been disclosed; anyone who has data with IDS Group should check for signs of exposure and take appropriate protective steps.
Breaking down the breach
The only confirmed public information is the May 25, 2026 listing itself. It asserts that files were removed from IDS Group systems. No independent confirmation of the data volume, encryption status, or restoration of operations has been released. Timing of the intrusion, the initial access method, and any ransom demand or payment are not disclosed in available records.
Who is rhysida?
Rhysida is a ransomware operation that has appeared in public reporting since 2023. The group typically uses double-extortion tactics: it claims to encrypt systems and to copy files for later publication if a ransom is not paid. It maintains a leak site where it lists victim names and sometimes posts samples of material. Prior activity attributed to the group includes incidents involving healthcare providers, educational institutions, and government contractors, though each case rests on separate evidence. In the present matter the group claims responsibility for the IDS Group listing; that claim has not been verified by the company or by law-enforcement statements released to date.
IDS Group and its sector
IDS Group describes itself as an award-winning multi-discipline design, engineering, and management consulting firm headquartered in Southern California. Organizations of this type routinely manage project documentation, client specifications, engineering drawings, contract records, and internal administrative files. Because their work often intersects with public infrastructure, real-estate development, and private-sector construction, the data they hold can include both proprietary designs and information about third-party clients or partners.
What data was at risk
The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types, no count of records, and no confirmation that personal data of clients or employees were among the materials have been published. Firms in this sector commonly store project correspondence, financial documents, employee records, and client-supplied information; however, whether any of those categories were actually removed in this incident remains unconfirmed.
Why it matters
Exposure of internal engineering and management files can affect project timelines, competitive positioning, and relationships with clients who supplied confidential specifications. If personal data of employees or third parties were included, those individuals could face risks of identity misuse or targeted follow-on contact. For the organization, the incident adds operational costs for investigation, potential regulatory notifications, and the need to review security controls around file storage and remote access.
If your data was in this claimed breach
Begin by watching official statements from IDS Group for any notification process. Enable or review multi-factor authentication on accounts that may share email addresses or credentials with the firm. Request copies of any personal records the company holds about you and ask how they are secured. Individuals can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of that address in other incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Stelia North America Listed by rhysida Ransomware GroupLakeside Union School District Listed by rhysida Ransomware GroupCharles Leonard Steel Services Listed by rhysida Ransomware GroupLMHT Associates Listed by rhysida Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the IDS Group Listed by rhysida Ransomware Group →
Publicly posted by rhysida — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.