Marlex Human Capital Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 25, 2025, the ransomware group rhysida listed Marlex Human Capital on its leak site and stated that internal files had been taken during an attack. The number of people whose information may be involved is not known, and no further details about the scope or contents of any data have been made public. For individuals connected to the organization through employment or recruitment processes, this leaves open questions about whether records that identify them or describe their work history have left the company’s control.

Inside the incident

The only confirmed public information is the date the listing appeared and the group’s assertion that internal files were exfiltrated. No figure for the volume of data, the number of records, or the number of individuals affected has been released. The method of initial access and the timeline of the operation have not been disclosed. Marlex Human Capital has not issued a statement confirming or disputing the listing.

The group behind it: rhysida

Rhysida is a ransomware operation that has been publicly tracked since 2023. The group typically uses encryption to disrupt operations and claims to copy data beforehand, then posts samples or lists of victims on a leak site to pressure organizations into payment. Its targets have included entities in multiple countries and sectors. In this case the group claims to hold material from Marlex Human Capital; that claim has not been independently verified in public reporting.

About Marlex Human Capital

Marlex Human Capital operates in the human-resources and staffing sector. Organizations of this type routinely collect and store employment applications, payroll information, background-check results, and records that link individuals to their work history and compensation. A breach at such a firm is consequential because the data often includes identifiers and details that remain relevant for years after an employment relationship ends.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No specific categories of data—such as names, contact details, identification numbers, or financial records—have been named. Organizations in this sector commonly hold personal and employment-related information, yet the exact contents of the material claimed by the group remain unconfirmed.

The real-world impact

People whose records may be involved could face risks of targeted phishing, identity misuse, or unwanted contact if the files contain contact information or employment histories. The organization itself may experience operational disruption from any encryption that accompanied the claimed exfiltration, along with costs associated with investigation and notification. Because the scale of exposure is not yet known, the full extent of these effects cannot be measured at present.

What to do if you're exposed

Individuals can monitor their email accounts for unusual activity and consider placing fraud alerts with credit-reporting agencies. Changing passwords for any accounts linked to the organization and enabling multi-factor authentication where available are standard first steps. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in public listings from this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.