INTAX, Inc. Data Breach

On October 29, 2026, the Rhysida ransomware group added INTAX, Inc. — a US-based professional services firm — to its leak site. SOCRadar observed the listing through its ransomware leak-site monitoring. No public domain appears in available ransomware tracking sources, which limits external analysis of the organization. Nevertheless, the listing itself reflects Rhysida’s willingness to target organizations that do not maintain a prominent web presence, and it aligns with the group’s ongoing targeting of North American professional services firms. Companies in this sector may hold client tax, financial, and personal data that carries clear extortion value even when their public digital footprint is small. Rhysida has listed 29 victims in the past 60 days, with its activity concentrated in the United States, Germany, and Canada. Professional Services and Financial Services feature consistently among its most frequently targeted industries. Recent listings span IT services (NEAD Pro), logistics (Legis), German trade associations (Kreishandwerkerschaft Borken), pharmaceutical distributors (MPA Pharma), and consumer goods firms (Axdia International). INTAX fits squarely within the group’s established North American professional services targeting pattern, matching both the geographic concentration and the sector focus observed in its recent victim selection.

No public domain is associated with INTAX, Inc. in available tracking sources, so no stealer-log query could be performed for this victim at the time of publication. The domain-based telemetry that normally supports credential-exposure analysis is therefore unavailable, and no records were found or ruled out because the dataset simply could not be queried. This absence of analysis does not confirm that the organization is unaffected. Credentials may exist under alternate corporate domains or personal email aliases, records may be present in feeds outside the queried dataset, credentials may have been used and rotated before indexing, or data may not yet have been indexed. The absence of evidence is not evidence that no compromise occurred. The limitation itself is analytically significant: Rhysida’s targeting criteria are evidently satisfied by factors that do not require a large public digital footprint, such as internal access, employee credentials, or data value that is invisible from the outside. Credentials harvested from SaaS platforms, VPN clients, and cloud services accessed from infected endpoints do not require a company website to end up in underground markets. Infostealer-harvested credentials of this kind may support ransomware operations, whether sold by initial access brokers or used directly, giving operators potential paths into corporate accounts, Microsoft 365 environments, VPNs, and remote-access portals. This remains a possible intrusion scenario rather than a confirmed access method for this incident. Given the limited external visibility, continued dark web and stealer-log monitoring is recommended, along with proactive credential-hygiene checks, password rotation where exposure is suspected, a multi-factor authentication review, and monitoring of Microsoft 365, VPN, and remote-access activity for signs of unauthorized use.