The Big Life group Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations across the public, private and third sectors, often combining encryption with the theft of internal data to increase pressure. Listings on criminal leak sites have become a routine feature of this landscape, even when independent confirmation of what was taken remains limited. Against that backdrop, a July 2023 claim involving a UK social-purpose organisation illustrates how quickly such incidents can surface and how little verified detail is sometimes available at the outset.

On 14 July 2023, the ransomware group known as rhysida listed The Big Life group on its leak site. Public reporting describes the incident as involving internal files exfiltrated in a ransomware attack. The number of people affected has not been disclosed, and further technical particulars remain limited in open sources. For an organisation whose work centres on supporting people and communities, any confirmed exposure of internal material carries clear implications for trust and for those whose details may appear in operational records.

Breaking down the breach

According to available public information, The Big Life group was listed by the rhysida ransomware group on 14 July 2023. The reported characterisation of the incident is that internal files were allegedly exfiltrated in a ransomware attack. No confirmed figure for the number of individuals affected has been published. The precise method of initial access, the duration of any unauthorised presence on systems, and whether encryption was successfully deployed alongside the claimed theft are not detailed in the material at hand. What is known is limited to the leak-site listing itself and the high-level description of internal-file exfiltration. Independent verification of the full scope has not been set out in the facts provided, so the listing should be treated as a claim by the group rather than as a fully corroborated account.

The group behind it: rhysida

Rhysida is a ransomware operation that became publicly visible in 2023. Like many contemporary groups, it has been associated with a double-extortion model: encrypting systems where possible while also stealing data and threatening to publish it if demands are not met. The group has typically advertised victims on a dedicated leak site, sometimes releasing sample files to support its claims. Public reporting has linked rhysida to attacks across multiple sectors and geographies, often using relatively standardised ransomware tooling and affiliate-style operations. None of that general pattern, however, constitutes proof of every specific allegation the group makes about an individual victim. In this case, the facts establish only that rhysida listed The Big Life group and that the incident has been described as involving exfiltration of internal files; no further claims attributed uniquely to this victim beyond that listing are recorded here.

The Big Life group and its sector

The Big Life group describes itself as being in the business of changing lives, working with people and places to fight inequality, create opportunities and inspire change. Organisations of this kind typically sit in the social enterprise, charity or community-support space. They often deliver services that bring them into contact with vulnerable or disadvantaged individuals, partner agencies, staff and volunteers. As a result they commonly hold operational records, case-related information, employment data and correspondence that are sensitive even when they are not strictly clinical or financial. A breach affecting such an organisation matters because the people it supports may already face heightened risks from identity misuse, stigma or disruption of services. The sector as a whole has seen repeated targeting by ransomware actors who recognise that reputational pressure and duty-of-care obligations can intensify the impact of a leak-site threat.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No itemised inventory of data types—such as names, contact details, case notes, financial records or staff information—has been disclosed in the material provided. Organisations engaged in community and inequality-focused work ordinarily maintain a range of internal documents: service-user or client records where relevant, staff and volunteer files, partnership agreements, internal communications and operational databases. Whether any of those categories were present in the material rhysida claims to hold is unconfirmed. Readers should therefore treat the exact contents as unknown until the organisation or a competent authority provides a clearer account. Speculation about specific fields or volumes would go beyond the evidence.

The real-world impact

When internal files from a social-purpose organisation are taken, the practical risks depend entirely on what those files actually contain. If personal details of service users, staff or partners were included, affected individuals could face phishing, social-engineering attempts or other misuse of their information. Even purely administrative material can assist criminals in crafting convincing frauds. For the organisation itself, consequences may include operational disruption, regulatory notification duties, costs of investigation and remediation, and damage to the confidence of the communities it serves. Because the number of people affected remains unknown and the precise data types are not publicly itemised, the scale of individual harm cannot be stated with certainty. The prudent assumption is that anyone who has had meaningful contact with the organisation—clients, employees, volunteers or partners—should remain alert to unusual contact or requests that appear to reference their relationship with The Big Life group.

Were you affected?

If you have been a service user, employee, volunteer or partner of The Big Life group, treat the July 2023 listing as a reason to take basic precautions. Monitor bank and account statements for unfamiliar activity, be wary of unexpected emails or calls that pressure you for information or payments, and consider changing passwords on important accounts if you reused any credential that might have been stored in organisational systems. You may also wish to enable multi-factor authentication where it is available. For a practical next step, you can run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. If you receive formal notification from the organisation, follow the specific guidance it provides, as that will be based on whatever has been verified internally.

AICompiled with AI assistance from public sources and published under our editorial standards.