The Rhysida ransomware group has launched a severe attack on Easterseals, one of the largest disability-focused nonprofits in the U.S., seeking a $1.3 million ransom. Easterseals provides vital services to over 1.5 million people, including disabled children, veterans, and seniors, and supports 100,000 physicians across the country. This week, Rhysida added Easterseals to its leak site, demanding 20 bitcoin by October 30.
Easterseals confirmed a breach to regulators, describing an April 1 cyberattack that disrupted its network and impacted access to critical systems. Following the incident, Easterseals promptly disconnected its network and engaged cybersecurity experts for an in-depth investigation, confirming that personal data had been compromised. Affected information includes names, addresses, driver’s license numbers, Social Security numbers, and medical data, impacting over 14,800 individuals.
Victims are now being provided 12 months of identity protection, and Easterseals has enhanced its security measures with endpoint protection, cloud-based servers, and multi-factor authentication to prevent future incidents.
Rhysida, known for its attacks on healthcare and public service organizations, has previously targeted major hospitals and nonprofits, including The Ann & Robert H. Lurie Children’s Hospital in Chicago and the World Council of Churches. This year, the group also disrupted operations at the Port of Seattle and the city of Columbus, Ohio. Rhysida’s continued targeting of vulnerable institutions highlights the escalating threat ransomware poses to critical service providers.

