Ransomware News
Noelker and Hull Data Breach: Rhysida Ransomware Claim (Oct 2026)
Admin
HookPhish team
Summary
In the latest cybersecurity news, Noelker and Hull — an organization based in US — has fallen victim to a ransomware attack conducted by the group rhysida. This data breach, discovered on 2026-10-28T16:59:06.260497+00:00, underscores the increasing need for proactive cybersecurity defenses as we continue through 2026.
Incident Report
| Attribute | Information |
|---|---|
| Target Organization | Noelker and Hull |
| Threat Group | rhysida |
| Summary | Noelker and Hull NHA-FULL � US ARCHITECTURE FIRM (est. 1971) – HEALTHCARE / SENIOR-LIVING DESIGN – COMPLETE INTERNAL FILE-SERVER – FRESH TO 2026No credentials in this lot (excluded by decision). Focus: identity and familypackages, payroll SQL, tax/bank pipes, litigation, seals & signatures, 26 GB mail.SUBJECT – Noelker and Hull Associates, Inc. (Chambersburg PA, est. 1971) + KAPClegacy (Frederick MD). ~41 employees, 9 shareholders. Revenue $8.56M -> $7.01M.~990 delivered projects: Penn State Health, WellSpan, Meritus, UPMC, SelectMedical, Tower Health, Holland America, Hershey, Gettysburg College – incl.hospital & crisis-center plans.KEY NUMBERS: 990 project folders | 30+ healthcare clients | 26 GB mail |60+ SSN rows | exec passports+DL x4 | edge 2026.INVENTORY – raw files from the firm’s servers, values masked, full set on close.[1] IDENTITY & FAMILY PACKAGES – FULLZ – ~80-100 PA residentsPassports+DL of the President and VP (x4); W-2 with full SSN (SSA TY2024),pay stubs (VP, YTD ~$116K, 07/2026), 401(k) x2, I-9; background checks -MD Criminal History + FBI Identity History + fingerprints.’Kennedy’: SSN, mortgage 03/2024, 3 child birth certs, child medical.’Karpowicz’ (employee’s mother, dementia): Medicare MBI, bank accounts,Morgan Stanley check $86,650.68, returns 2022-2025, IRS POA.’Hoffman’: UPMC/WellSpan medical, custody. + ~62 resumes, phones ~45.Below PA AG >500 bar – but every name is a plaintiff (Dittman) + a victim.[2] PAYROLL – Ajera ERP SQL backups, 140 tablesSSN x61+ | Salary x459 | W-2 x1151 | 1099 x991 | DirectDeposit x176 |BankAccount x1503. Full compensation/bank anatomy for payroll-diversion.[3] TAX & FINANCE – Form 1120 x4 yrs, QuickBooks (KAPC); PPP $802,480 +$803,347.83 forgiven; IRS audit TY2020 closed no-change; BlueRidge acct104729, positive-pay exports. Fraud precedent: forged checks $45.5K (2022)+ fraudulent SBA EIDL #7672918108 in the firm’s name – scheme proven.[4] LITIGATION – ACTIVE: PJ Dick v. Lehigh No. 2026-C-2439, $13M+, ‘designerrors, omissions’ against NHA � internal assessments, stop-work, delayclaims. Fleet Landing demand ~$1.41M. Vincentian ‘DO NOT MOVE OR DELETE’hold; SpiriTrust privileged folder; CIA subpoena response.[5] FORGERY KIT – signatures of 14 employees + architect seals (MD/PA); ~140Certificates of Insurance; license keys (Autodesk/Adobe) bonus.[6] COMMERCIAL SECRETS – fee pipeline 2010-2026 (5.00-8.50%, markup 10%,Hourly Rates, Past-Due notices); Meritus master specs; CAD Standards37.7 GB; aborted Olsen merger docs.[7] MAIL – ~26 GB, into 2026. Indexed sample: 6,195 msgs – 401(k)/ERISA/PHI.Rest as-is, unprobed.[+] AS-IS – encrypted browser stores x3 (OWA/banks/PayPal/USCIS listed),Credential Manager x91, .pfx, ACT! DB. Unproven, not in the price.FRESHNESS – A�live: pay stubs 07/2026, COI to 05/2027, case 2026-C-2439, mail.B�recent: Ajera, pipeline, returns 2022-25, litigation. C�archival (KAPC2009-14): W-2, background – SSN/biometrics don’t expire.BUYERS – elder-fraud/fullz (1); BEC/payroll-diversion (2+3); competitor AEC (6);PA/MD plaintiff bar (1+4); contractor scams (5).DEAL – mockup only. 1. Sample: masked docs, table-list screenshot, watermarkedseal, SHA-256 manifest. 2. Escrow, multi-sig; whole lot or per-section split.3. Dead-drop container, hash check vs. manifest, proof-of-deletion on exclusive.DISCLAIMER – HYPOTHETICAL RED-TEAM SCENARIO from a confirmed forensic inventory(60 findings). Nothing is offered for sale. Credential rotation = UNVERIFIEDassumption (artifacts dated 2026). ‘~’ = enumerated; unparsed = unproven. More |
| Date of Breach | 2026-10-28T16:58:28.226154+00:00 |
| Discovery Date | 2026-10-28T16:59:06.260497+00:00 |
| Region | US |
| Business Sector | Professional Services |
How to reduce your ransomware risk
Most ransomware intrusions start with a stolen password or a phishing email. A few proactive steps sharply cut your exposure:
- monitor the dark web for leaked logins — close the gap attackers exploit.
- continuous breach monitoring — close the gap attackers exploit.
Want to know if you’re already exposed? Run a free scan with the HookPhish data breach checker.
Disclaimer
HookPhish does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.
