Ransomware group rhysida hits INTAX, Inc.
INTAX, Inc. — a financial services target has been listed by the rhysida ransomware group on 2026-10-29. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | INTAX, Inc. |
|---|---|
| Threat Group | rhysida |
| Summary | INTAX, Inc., a financial services organization, was listed by the rhysida ransomware group on its leak site on 2026-10-29. |
| Date of Breach | 2026-10-29 |
| Discovery Date | 2026-10-29 |
| Region | — |
| Target Domain | — |
| Business Sector | Financial Services |
| Severity | HIGH |
Claim by rhysida
INTAX, Inc. Complete file server of INTAX, Inc. (Lexington, KY, USA) - a property-tax compliance and bill-pay firm.892,867 files, 1.27 TBClient tax returns: 649,905 PDFs. Clients include AARP, ADT, Pilot Travel Centers, Wendy's, Valvoline, Zions, Raytheon (~100 companies).Client accounting: 100+ QuickBooks company files � full ledgers, banks, payroll.Money: bank account + routing numbers, $910,000 wire form, signed W-9, proof the firm opens dedicated accounts and pays client taxes (~$73.6M/yr moved).Identity data: US passports of the owner and employees, driver license, birth certificate, W-2s with SSNs, IRS filings 2025�2026, medical insurance cards.60+ cleartext password files: US government tax portals + the firm's own QuickBooks.24,000+ emails, personal employee folders, lawsuit records, owner exit/sale planning. More
Posted by the rhysida threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Leak post (onion / Tor)
http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/archive.php?company=293
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.