Hudson River Housing over the weekend disclosed a March 2025 data breach that compromised the following personal info:
- Names
- Social Security numbers
- Bank info
- Driver’s license numbers
- Dates of birth
Hudson River Housing has not disclosed how many people it notified in total.
A ransomware group called Rhysida took credit for the breach on its data leak website in June 2025. To prove its claim, Rhysida posted sample images of what it says are documents stolen from Hudson River Housing.
Rhysida demanded 7 bitcoin in ransom, worth about $744,000 at the time.
Hudson River Housing has not acknowledged Rhysida’s claim, and Comparitech cannot independently verify it. We do not know if Hudson River Housing paid a ransom or how attackers breached its network. Comparitech contacted Hudson River Housing for comment and will update this article if it replies.
“Hudson River Housing alerted to unauthorized access to its network on or around April 28, 2025,” says the organization’s March 13, 2026 notice (PDF) to breach victims. “[…] we discovered on March 5, 2026, that certain files contained protected personal information and may have been removed from the network by an unauthorized third-party actor.”
Hudson River Housing is offering breach victims free credit monitoring through Epiq Privacy Solutions.
Who is Rhysida?
Rhysida is a cybercriminal group that first surfaced in May 2023. Its ransomware can steal data and lock down targeted systems. It then demands a ransom both for deleting stolen data and for a key to restore infected devices. Rhysida operates a ransomware-as-a-service business in which affiliates pay Rhysida to use its malware and infrastructure to launch attacks and collect ransoms.
Rhysida has claimed responsibility for 265 ransomware attacks in total. Of those, 107 were confirmed by the targeted organizations, which notified 5.6 million people in total. Rhysida’s average ransom demand is $1.08 million.
Rhysida has taken credit for breaches at multiple public service and non-profit organizations, including:
- The World Council of Churches/Lutheran World Federation in Switzerland reported a December 2023 data breach for which Rhysida demanded $280,000
- The Big Life Group in the UK notified 62,500 people of a June 2023 data breach
- Project Hospitality in the USA reported a July 2024 data breach for which Rhysida demanded $867,000
- The Chicano Federation of San Diego County reported a December 2024 data breach for which Rhysida demanded $675,000
- Welthungerhilfe in Germany refused to pay Rhysida’s $2.15 million ransom demand following a May 2025 data breach
Ransomware attacks in the USA
In 2025, Comparitech researchers logged 673 confirmed ransomware attacks on American organizations, which in turn notified 43.6 million breach victims.
Other non-profits to recently confirm attacks include the Children’s Council of San Francisco, which notified 12,655 people of an August 2025 data breach claimed by SafePay, and the National Association on Drug Abuse Programs, which reported a January 2026 data breach claimed by Genesis.
In 2026 to date, we’re monitoring 845 attack claims made by ransomware gangs, 30 of which have been confirmed so far.
Ransomware attacks can both lock down computer systems and steal data. The attackers then demand a ransom to restore infected systems and delete stolen data. Organizations that refuse to pay can face permanent data loss, extended downtime, and putting data subjects at increased risk of fraud.
About Hudson River Housing
Based in Poughkeepsie, NY, Hudson River Housing is a charity that develops and provides affordable permanent, transitional, and emergency housing in the Hudson Valley.
