Carthage, Texas Hit by Rhysida Ransomware Attack, Exposing Sensitive Data of Nearly 6,000 The city of Carthage, Texas, confirmed a December 2024 data breach affecting at least 5,868 individuals, with compromised records including names, Social Security numbers, financial account details, medical information, state-issued IDs, health insurance data, taxpayer IDs, and dates of birth. Notifications were sent to 5,858 Texas residents, along with seven in Massachusetts and three in Maine, though additional victims in other states may emerge. The Rhysida ransomware group claimed responsibility in January 2025, listing the stolen data for sale on its leak site for 5 bitcoin (over $500,000 at the time) and posting sample documents as proof. Carthage officials have not publicly acknowledged Rhysida’s involvement, and key details such as the attack vector, whether a ransom was paid, or the delayed notification remain unconfirmed. The city first detected unauthorized access on December 17, 2024, but did not notify victims until February 20, 2026. ### Who Is Rhysida? Emerging in May 2023, Rhysida operates as a ransomware-as-a-service (RaaS) group, providing malware and infrastructure to affiliates in exchange for a cut of ransom payments. The group has claimed 264 attacks, with 105 confirmed, exposing the personal data of roughly 5.6 million people. Government entities are frequent targets 22 of Rhysida’s confirmed attacks have hit public-sector organizations, including a December 2025 breach of the Cheyenne and Arapaho Tribes, where the group demanded $682,000 (the tribes refused). In 2026, Rhysida also targeted Elabs, a German IT firm, with a $392,000 ransom demand. ### Ransomware’s Growing Threat to Government Entities The Carthage breach is part of a broader surge in ransomware attacks on U.S. government systems. Researchers recorded 92 confirmed attacks in 2024 and 84 in 2025, with average ransom demands nearing $2 million. Recent incidents include: - Cocoa, Florida: Still recovering from a January 2026 attack claimed by Inc Ransomware. - Tulsa International Airport: Disclosed a January 2026 breach linked to Qilin. - Peabody, Massachusetts: Notified 48,000 people of a June 2025 breach by Interlock. - York, Pennsylvania: Paid a $500,000 ransom after a July 2025 attack. These attacks disrupt critical services from emergency dispatch to court records and force governments to choose between paying ransoms, facing prolonged downtime, or risking permanent data loss and fraud for affected individuals. Carthage, a city of 6,600 in eastern Texas, has not responded to requests for further details.