Avannubo Listed by rhysida Ransomware Group

On June 21, 2023, Avannubo, a licensed provider of IP telephony, mobile phone services, and Internet access, was listed on the leak site of the Rhysida ransomware group. The listing states that internal files totaling 165 GB across 198,760 documents were exfiltrated during a ransomware attack and have now been made fully public. The number of people whose personal data appears in those files remains unknown.

Details from the Leak Site

The Rhysida leak page explicitly claims that all files were uploaded to public access and invites “data hunters” to review them. The disclosure indicates that the data consists of internal company documents obtained after the ransomware deployment. No specific categories of personal information, such as customer names, phone numbers, billing records, or employee details, are itemized on the listing itself. The primary source does not quantify how many individuals are affected, nor does it provide a sample of the exposed material.

Avannubo’s customers and employees therefore face uncertainty about exactly which records reached the open internet. Because the files are described as internal and total nearly 200,000 separate documents, the breach carries the realistic possibility that customer contracts, service logs, payment information, or staff records were included.

Why This Matters for You and Your Family

If you or anyone in your household has used Avannubo’s telephony, mobile, or broadband services, your contact details, account numbers, or billing history may now sit in an easily downloadable 165 GB archive. Once that volume of internal data reaches public forums, it rarely stays contained. Identity thieves, phishing operators, and extortionists routinely scan fresh ransomware leaks for usable information. Even if your records are not immediately obvious, the exposure creates a long-term risk that your data will surface in future fraud attempts or be bundled and sold on underground markets.

Children’s accounts tied to a family address or shared phone plan are especially vulnerable. A leaked parent name or household address can be linked to a child’s gaming username or school-issued email, opening the door to targeted harassment or account takeovers that affect the entire family.

The Doxxing and Identity-Chain Risk

Ransomware leaks like this one frequently trigger extended doxxing chains. A single internal spreadsheet containing names, phone numbers, and email addresses can be cross-referenced with data from earlier breaches, social-media profiles, and public records. Within weeks, attackers can assemble a detailed profile that links your work number, home address, children’s names, and online handles. That profile then becomes the foundation for SIM-swapping attempts, credential-stuffing attacks across other services, or personalized extortion demands. Because Avannubo provides communication services, the exposed files may contain precisely the kind of contact data that accelerates these chains.

Rhysida’s Known Track Record

Public reporting attributes the first notable Rhysida campaigns to mid-2023. The group rapidly gained attention for targeting healthcare providers, technology companies, and critical infrastructure organizations. Its typical playbook begins with initial access through compromised remote desktop credentials or exploited vulnerabilities, followed by exfiltration of sensitive files before ransomware is deployed. After encryption, Rhysida posts a sample of stolen data and demands payment to prevent full publication. When victims do not pay, the group releases the material in bulk, as appears to have occurred with Avannubo. The leak site uses an onion address and maintains a professional presentation that encourages broad redistribution of the stolen archives.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the Avannubo breach.
• Rotate any password you ever used with Avannubo and enable 2FA through an authenticator app on every other account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is flagged within hours rather than months.
• Cover the household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address or phone number found in provider leaks.
• Let DoxxScan remediation specialists handle takedown requests for any personal records that have already reached data-broker sites fed by this incident.

The Avannubo listing is a reminder that even mid-sized communications providers can become gateways to widespread personal exposure. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain that now begins with this 165 GB release. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly includes children’s gaming accounts at risk from cascading credential leaks like this one.