A new addition has been made to the cyber-rogues’ gallery of ransomware gangs as Rhysida takes responsibility for an attack on the British Library. The library has confirmed that personal data stolen in a cyber-attack last month has appeared for sale online. Rhysida is using a classic double extortion ransomware attack, where they infect an organization’s computers with malware and demand payment in cryptocurrency to unlock the files. They also steal data and threaten to release it online to strengthen their negotiating position. Rhysida has posted low-resolution images of the stolen data online and is offering it for sale with a starting bid of 20 bitcoin. The group has also targeted government institutions in Portugal, Chile, Kuwait, and a US hospital group. US government agencies have released an advisory note on Rhysida, stating that it has been deployed against various sectors since May and is running a ransomware as a service operation. Rhysida is a rebranding of the criminal group Gold Victor, which operated a ransomware scheme called Vice Society. The exact identity of the Rhysida gang is unknown, but it is believed they are Russian-speaking or from the Commonwealth of Independent States. The gang uses common access techniques such as phishing attacks and virtual private networks to gain entry into systems. Cryptocurrency is the preferred form of ransom demand for Rhysida attackers due to its decentralization and difficulty to track. Paying ransom demands is heavily discouraged by law enforcement in both the UK and the US, but ransomware payments are on the rise.