Milicic Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized industrial and services firms across Latin America, treating operational data as leverage in double-extortion campaigns. Against that backdrop, the Argentine construction company Milicic appeared on a ransomware leak site in late April 2025, an event that underscores how even established regional contractors can become listed targets.

Public reporting states that Milicic was listed by the rhysida ransomware group on 23 April 2025 after the group claimed to have exfiltrated internal files. The number of people affected remains unknown, and further technical details have not been released. The listing itself is a claim by the threat actor; independent confirmation of the intrusion or the full scope of data taken has not been published.

Breaking down the breach

According to the available record, Milicic was named on the rhysida leak site on 23 April 2025. The group asserts that it carried out a ransomware attack and exfiltrated internal files. No public statement from the company confirming the incident, the date of initial access, the encryption of systems, or any ransom demand has been included in the reported facts. The number of individuals whose information may have been involved is listed as unknown. Exact file volumes, specific systems compromised, and the method of initial intrusion remain undisclosed.

In short, the only concrete public elements are the listing date, the attribution to rhysida, and the claim that internal files were taken. Everything else—timeline, scale, and technical vector—has not been detailed in open sources.

Who is rhysida?

Rhysida is a ransomware operation that emerged in 2023 and has since conducted double-extortion attacks: encrypting victim systems while also stealing data and threatening to publish it if a ransom is not paid. The group typically operates a dedicated leak site where it posts victim names, sample files, and countdown timers. It has previously claimed attacks against healthcare providers, educational institutions, government contractors, and industrial firms in multiple countries. Rhysida often uses phishing or compromised credentials for initial access, deploys ransomware payloads that encrypt files with strong cryptography, and then advertises the stolen data to pressure payment. Its listings are claims; they do not automatically prove that every named organisation suffered a claimed breach of the scale advertised.

In this case the group claims Milicic as a victim and states that internal files were exfiltrated. No additional statements attributed specifically to this incident—such as ransom amounts or sample data releases—appear in the public facts provided.

About Milicic

Milicic describes itself as an Argentine construction and services company with fifty years of experience in large-scale projects that support key productive sectors. Firms of this type typically manage civil-engineering works, industrial facilities, infrastructure, and related logistical services. They routinely hold contracts, engineering drawings, supplier agreements, employee records, client correspondence, financial data, and project schedules—information that is operationally sensitive and sometimes commercially confidential.

A breach at such an organisation matters because construction companies sit at the intersection of private industry and public infrastructure. Disruption or data exposure can affect project timelines, supply-chain partners, and the personal information of workers and subcontractors. The company’s long operating history also means it may retain older archives that contain decades of accumulated records.

What data was at risk

The reported facts state only that “internal files” were exfiltrated in a ransomware attack. No further breakdown—such as employee personal data, client contracts, financial statements, or technical drawings—has been disclosed. The number of people affected is unknown.

Organisations in the construction and industrial-services sector commonly store personnel files, payroll details, identity documents, project bids, blueprints, vendor invoices, and correspondence with public agencies. Whether any of those categories were among the files claimed by rhysida remains unconfirmed. Readers should treat the precise contents as undisclosed until verified by the company or independent investigators.

What's at stake

For individuals whose information may have been present, the practical risks include identity misuse, targeted phishing that references real project or employment details, and potential exposure of contact or financial data. Because the exact data types and the number of affected people are unknown, the scale of personal harm cannot yet be quantified.

For the organisation, the stakes include possible operational disruption if systems were encrypted, reputational damage from the public listing, contractual or regulatory obligations to notify partners and authorities, and the cost of forensic investigation and remediation. Even if systems were restored from backups, the claimed exfiltration of internal files creates an ongoing risk that sensitive material could be sold or released. These consequences are typical of ransomware incidents of this kind; they are not unique to Milicic and do not imply any established finding of negligence.

If your data was in this claimed breach

If you have worked for, contracted with, or otherwise shared personal information with Milicic, treat the possibility of exposure seriously until more details emerge. Monitor financial accounts and credit reports for unusual activity, enable multi-factor authentication on email and other accounts, and be alert to phishing messages that reference construction projects or Argentine business contacts. Change passwords that may have been reused across services. Because the number of people affected and the precise data types remain unknown, these steps are precautionary rather than responses to confirmed individual compromise.

You can also run a free exposure scan of your email address to check whether it has already appeared in other known breach data sets. That check will not confirm or rule out involvement in this specific incident, but it can surface earlier exposures that warrant attention. Stay informed through official company notices or trusted public reporting as further verified information becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.