The Rhysida ransomware group added INTAX, Inc., a property-tax firm in Lexington, Kentucky, to its dark web leak site on October 29, 2026. The group says it stole about 1.27 TB of data across 892,867 files. Breach-tracking sites QPulse and Yazoul both report those figures. According to QPulse's description of the listing, the files include client tax returns, QuickBooks ledgers, bank details, identity documents, and more than 60 files holding plaintext passwords for US government tax portals. All of this comes from the attackers. INTAX has made no public statement, no regulator filing or breach notice has been published, and no outside researcher has said they checked the data. Treat the volume and contents as the group's claim, not as established fact.
What Happened
Several monitoring services saw the leak-site listing on October 29. ClassAction.org cites Ransomware.live as the first report and says the attack was estimated to have happened the same day. HookPhish also reported the claim. ThreatMon flagged the listing in its feed as well, and Undercode News republished it twice.
The level of detail in these reports varies. QPulse and Yazoul describe a listing with file counts, data categories and named clients, and Yazoul says it captured a screenshot of the leak-site post. Undercode News, working from ThreatMon's notification, says that alert carried only the company name and a finance-sector label: no sample files, no ransom note and no technical evidence. The listing may have been updated after ThreatMon's first alert, or the monitoring services may simply have captured different amounts of it. Either way, the detailed inventory in this brief comes mainly from QPulse's write-up.
Descriptions of the company also differ. QPulse and Yazoul call INTAX a property-tax compliance and bill-pay firm serving corporate clients. ClassAction.org calls it a property tax consulting firm that handles compliance, appeals and advisory work for businesses. One tracker, cyberthreatintelligence.net, lists the victim's country as "Unknown." Most reports, though, place the company in Lexington.
Attorneys working with ClassAction.org have opened an investigation into a possible class action. They are asking current and former INTAX employees, and people connected to its clients, to get in touch. At the time of their post, they said no further details about the scope of the incident were available.
What Was Taken
Every item below is the attackers' claim, as reported mainly by QPulse. Yazoul gives a shorter summary that matches it: tax returns, accounting records, identity documents and internal communications.
- Tax records: 649,905 PDFs said to contain client tax returns, plus IRS filings for 2025 and 2026.
- Accounting data: more than 100 QuickBooks company files with full ledgers, bank details and payroll data.
- Payment data: bank account and routing numbers, wire forms, and signed W-9 forms. QPulse says INTAX used the W-9s to pay client taxes.
- Identity documents: US passports, driver's licences, birth certificates, and W-2s containing Social Security numbers.
- Credentials: more than 60 files said to hold plaintext passwords for US government tax portals and for the firm's own QuickBooks systems.
- Internal material: more than 24,000 emails, personal folders belonging to employees, and records of lawsuits.
QPulse says about 100 corporate clients appear in the data. It names AARP, ADT, Pilot Travel Centers, Wendy's, Valvoline, Zions and Raytheon. Only QPulse reports that list. None of those companies has commented publicly, and Yazoul warns that organisations named as clients should treat the claim as unconfirmed.
Why It Matters
If the claim holds up, the credentials are the most dangerous part. Plaintext logins for state and federal tax portals could let criminals file fake returns, redirect refunds or payments, or change taxpayer account details for INTAX's clients. They would not need to break into those clients' own networks to do it. Signed W-9s, bank routing details and wire templates are the raw material for payment fraud and business email compromise against clients' accounts payable teams.
This is a supply chain exposure. A property-tax firm that pays bills for its clients sits between large companies and the government agencies that collect from them. It handles both the money and the credentials. One breach at a firm like this can put dozens of organisations at risk at the same time.
The INTAX listing also fits a pattern in Rhysida's recent targets. On October 9, 2026, QPulse reported that the group published 1.84 TB from RealManage, a community association management company in Plano, Texas. That data reportedly included SSNs, W-9s, IRS 1099 e-file transmissions, ACH files and banking records for hundreds of homeowners' associations. Two large tax and finance data dumps within three weeks suggest Rhysida is going after service firms that hold financial records for many clients.
Victim counts for Rhysida vary, even within one source. Cyberthreatintelligence.net's tracker page shows 236 listed victims, while its own group profile says Rhysida has listed 295 victims since June 2023.
The Attack Technique
How the attackers got into INTAX has not been disclosed. No incident report or forensic finding has been published, and Undercode News notes that no evidence of the compromised systems has come out.
What is known about Rhysida in general comes from earlier public reporting. The group emerged in May 2023 and runs as ransomware-as-a-service. Cyberthreatintelligence.net's profile says it typically gets in through phishing and uses Cobalt Strike for post-exploitation. Yazoul adds PowerShell for lateral movement and payload delivery, plus the abuse of remote monitoring and management (RMM) tools. Rhysida practises double extortion: it encrypts systems, steals data, and threatens to publish it. It leaves PDF ransom notes that point victims to a payment portal, takes payment in Bitcoin, and has auctioned stolen data on its leak site. Researchers have linked it to the older Vice Society operation, though Yazoul notes that this link is still debated.
The claimed data suggests the attackers reached file shares, the QuickBooks environment and email. That points to broad access inside the network rather than one exposed system. This is an inference from the claimed contents, not a confirmed finding.
What Organizations Should Do
- If you are an INTAX client, rotate credentials now. Change every tax portal login, QuickBooks credential and shared account INTAX could have held. Enable multi-factor authentication wherever the agency supports it. Review recent portal activity for changed addresses, bank details or authorised representatives.
- Lock down payment changes. Warn accounts payable and treasury teams that real W-9s, wire forms and routing details may be in criminal hands. Require a callback to a known phone number before changing any vendor's or tax authority's payment instructions.
- Watch for tax identity fraud. Ask the IRS and state revenue departments about Identity Protection PINs and business account monitoring. Tax preparers that suffer a breach should report it to state revenue agencies. South Carolina's Department of Revenue, for example, accepts business breach reports through its ID Theft & Breach Report form. It asks for the affected FEINs, EFINs and PTINs, the breach date, the types of data taken, and the number of clients or employees affected.
- Prepare employees and individuals for identity theft. People whose passports, licences, birth certificates or SSNs may be in the data should consider credit freezes and fraud alerts. HR teams should brief staff on targeted phishing that uses details from the leaked files.
- Review your own tax and finance vendors. Make a list of third parties that hold your tax portal credentials or pay bills for you. Confirm they store secrets in a password vault rather than in documents, enforce MFA, and are contractually required to notify you of a breach quickly.
- Hunt for Rhysida's known tradecraft. Look for Cobalt Strike beacons, unusual PowerShell activity, unauthorised RMM tools and large outbound data transfers. Make sure you have offline backups and that email filtering is tuned against the phishing Rhysida typically uses to get in.
Sources: Rhysida Ransomware Group Exfiltrates 1.27 TB of Data from INTAX, In... | INTAX, Inc. Ransomware Attack by Rhysida (2026) Cyber Threat Intel... | INTAX Ransomware Claim by Rhysida (Oct 2026) | INTAX Data Breach? Attorneys Investigate Hackers' Claims | Rhysida Claims INTAX, Inc as a New Finance-Sector Victim, Raising F... | WhiteArmor Claims Rollyio and Rhysida Claims INTAX, Inc in New Vict... | Rhysida Ransomware Group Leaks 1.84 TB of Data from RealManage QPulse | Need to report a tax violation or identity theft? Make MyDORWAY you...