Rhysida claims ransomware attack on boat retailer MarineMax

MarineMax, described as the world's largest recreational boat, yacht and superyacht services company, told the US Securities and Exchange Commission on March 12, 2024 that a third party had gained unauthorized access to portions of its information environment two days earlier. The company said the incident caused some disruption to a portion of its business but had not had a material effect on operations, and that it did not maintain sensitive data in the affected environment.

The Rhysida ransomware group claimed responsibility later in March and posted material on its Tor leak site, including screenshots that appeared to show financial documents and spreadsheets. SecurityWeek reported the gang demanded 15 bitcoin, worth roughly $950,000 at the time, to stop the data being sold. Comparitech valued the same demand at about $1 million.

MarineMax operates dealerships and marinas worldwide and reported revenue of $2.39 billion for 2023. It notified law enforcement and engaged outside cybersecurity experts, and in a follow-up SEC filing on April 1, 2024 said the business disruption had been remediated.

The company's account of the data changed as the investigation progressed. Comparitech reported that MarineMax began notifying about 123,494 people in July 2024 that limited customer and employee data, including personally identifiable information, had been taken, and offered two years of identity monitoring.