The WEYHRO ransomware group has allegedly added two US-based organizations, Chemtron RiverBend and Community Services of Missouri, to its list of victims. The group posted claims on its dark web leak site, accompanied by evidence suggesting a significant data breach at both entities. Chemtron RiverBend is a major water-treatment solutions provider operating across the United States and Canada, known for its environmentally conscious services. Community Services of Missouri is a leading provider of court-ordered alcohol, drug, and driving-related programs across 16 locations in the state of Missouri, handling sensitive data for individuals involved in the justice system.
The threat actor claims to have exfiltrated a vast amount of sensitive data from both organizations, with the alleged proof including data analysis reports detailing the compromised files. The breach appears to be extensive, encompassing recent financial records, operational data, and highly sensitive personal information. The stolen information reportedly spans from historical archives to documents created as recently as July 2025, suggesting a deep and ongoing intrusion into the victims’ networks.
The following organizations were listed as victims in the alleged ransomware attack:
- Chemtron RiverBend: A prominent water-treatment provider for a wide variety of clients in the U.S. and Canada. The allegedly stolen data includes:
- Executive, ownership, and legal agreements
- Banking, payment operations, and accounts receivable
- Tax filings and regulatory compliance documents
- Financial accounting records and customer billing information
- Customer, vendor, and pricing data
- Operational datasets, lab reports, and archives
- Community Services of Missouri: A provider of state-approved programs such as SATOP, Ignition Interlock, and Defensive Driving for court-ordered requirements in Missouri. The allegedly stolen data includes:
- Credentials and access secrets for systems
- Highly sensitive PII/PHI including SSNs, tax returns, IDs, and medical reports
- QuickBooks company files and financial data
- Justice, court, and probation operational data, including case records and program rosters
- Employment/HR files and legal dispute materials
- Health and drug/urinalysis testing records
- Application source code and configuration files
