Ransomware Group rhysida Hits: MPA Pharma
Summary
In the latest cybersecurity news, MPA Pharma — an organization based in DE — has fallen victim to a ransomware attack conducted by the group rhysida. This data breach, discovered on 2026-09-18T13:48:49.890285+00:00, underscores the increasing need for proactive cybersecurity defenses as we continue through 2026.
Incident Report
| Attribute | Information |
|---|---|
| Target Organization | MPA Pharma |
| Threat Group | rhysida |
| Summary | MPA Pharma MPA Pharma GmbH is an internationally active, rapidly growing company specializing in the import and trade of high-quality pharmaceuticals, including both patented and generic products. 2,899,290 files, ~5.8 TBPharmaceutical companyCategories: accounting records and database backups, government audits (customs / corporate tax / social security / wage tax),corporate ownership (nominee structure, beneficial-ownership filings, related-party payments), narcotics/BtM records (opioids, cannabis, precursors),litigation files, executive and employee personal data, IT artifacts, pharmacovigilance correspondence.Credit cards with CVV of executives, Oltersdorf ID card valid until 2030, the Pfeiffer letter on the hidden Paranova Pack B.V., UBO passportsSQL backups (17.7 million general-ledger rows), commercial register extract (HRB), organizational chartCredentials (TIER 1) – a list of all password files (values not repeated here, stored in the MPA PASSWORDS report)Government audits – customs 17,011.77 EUR with a breakdown, corporate tax +202,203.18 EUR, social security (DRV) 23,134.96 EUR with a separate case against the managing director, wage-tax auditNarcotics (BtM) – permits (318 04 74), reconciliations of 588 rows / 93 differences, fentanyl, hydromorphone, oxycodone, tapentadol, unexplained remainders of 1-13 units, documentation gap 2017-2020, cannabis up to 22 percent THC, precursorsLitigation – MSD/Merck memo, settlement agreement, Amgros judgment 5,180,043.09 DKK, complaint to the Ministry of Health, arbitration filingPeople, security, pharmacovigilance, bulk financial recordsArtifacts – leadership phone book, employee medical documents, Eli Lilly 2025, AstraZeneca, rebate contracts, a list of all produced reports More |
| Date of Breach | 2026-09-18T13:48:02.770533+00:00 |
| Discovery Date | 2026-09-18T13:48:49.890285+00:00 |
| Region | DE |
| Target Domain | mpapharma.de |
| Business Sector | Healthcare |
How to reduce your ransomware risk
Most ransomware intrusions start with a stolen password or a phishing email. A few proactive steps sharply cut your exposure:
- train staff to spot attacks — close the gap attackers exploit.
- monitor the dark web for leaked logins — close the gap attackers exploit.
Want to know if you’re already exposed? Run a free scan with the HookPhish data breach checker.
Disclaimer
HookPhish does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.
Related articles
Ransomware Group N0n Hits: STOKR (digital securities platform)
Ransomware Group N0n Hits: AstraZeneca Türkiye
Ransomware Group N0n Hits: Argentem Creek Partners (investment firm)
