Here at Pope and Johnson County Title Company
Finans
Here at Pope and Johnson County Title Company Pope County Title Company - title insurance & escrow agency2,536,208 files, ~784 GBPope County Title Company / Johnson County Title / Carol Collins Law / Principle Escrow / Principle Intermediary (Russellville, AR) is a title agency closing real-estate deals for First American Title Insurance, running escrow trusts and acting as a qualified intermediary for IRS 1031 like-kind exchanges. Power title plant: 591,000-record county registry, 1983�2026 data;SoftPro daily closing documents 2020�2026 plus a SQL backup (fully restored and examined);WordData business documents: 1031 exchanges, escrow registers, HR, taxes, passwords.412 SSNs + 4,549 TaxIDs in the production database; 1,202 buyers/sellers from 2025+; fresh W-2/1099 for all staff (SSN, wages, addresses);scans of passports, driver licenses and Social Security cards of staff and clients;bank portal passwords in plain spreadsheets, plus security answers; Centennial / FSB account numbers, wire instructions, FUND escrow ledgers 2024�2026;owners' personal finances: joint 1040 returns 2002�2018 (spouses' SSNs), medical bills, investment accounts, SSA retirement application 12/2024;5th Judicial District criminal-case materials (the owner is a sitting public defender): Cellebrite phone extractions of defendants, jury instructions;law-practice case files: divorces, guardianships, estates. More
Data size
—
Files
—
Ransomware
Unknown
DayBreach AI intelligence
Timeline
Record updated
Victim announced
Attacker
Rhysida
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.<br> <br> The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.<br> <br> The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.<br> <br> After encryption, the ransomware appends the extension '.ryshida' to encrypted files.<BR>Source: https://github.com/crocodyli/ThreatActors-TTPs