medusa
First seen January 11, 2023Active518 claimed victims
The claims below are reproduced as posted by medusa on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| MESA Products | February 13, 2026 | ransomware_live | — |
| Grandview Family Medicine | February 8, 2026 | ransomware_live | — |
| Comune di Battipaglia | February 2, 2026 | ransomware_live | — |
| South Hays Fire Department | January 29, 2026 | ransomware_live | — |
| Balloons Everywhere | January 29, 2026 | ransomware_live | — |
| Resource Corporation of America | January 4, 2026 | ransomware_live | — |
| JBS | December 23, 2025 | ransomware_live | — |
| Callipo Group | December 17, 2025 | ransomware_live | — |
| Shamrock Technologies | December 13, 2025 | ransomware_live | — |
| Sampoerna Agro | December 13, 2025 | ransomware_live | — |
| Thunder Bay Counselling | December 13, 2025 | ransomware_live | — |
| Concord Academy | November 28, 2025 | ransomware_live | — |
| WR Comercial | November 24, 2025 | ransomware_live | — |
| Universidade Municipal de São Caetano | November 24, 2025 | ransomware_live | — |
| Nationwide Legal LLC | November 17, 2025 | ransomware_live | — |
| MFE Formwork Technology | November 17, 2025 | ransomware_live | — |
| FDC Interiors | November 17, 2025 | ransomware_live | — |
| General Distributing | November 17, 2025 | ransomware_live | — |
| Atrium Living Centers | November 8, 2025 | ransomware_live | — |
| PT Kalimantan Prima Persada | November 6, 2025 | ransomware_live | — |
| Oscars Group | November 5, 2025 | ransomware_live | — |
| LaRosa’s Pizzeria | November 5, 2025 | ransomware_live | — |
| Clackamas Community College | October 29, 2025 | ransomware_live | — |
| Simon Property Group | October 28, 2025 | ransomware_live | — |
| Alissa Group | October 22, 2025 | ransomware_live | — |
| Cooperativa Esercenti Farmacia Scrl | October 22, 2025 | ransomware_live | — |
| ATIRG | October 22, 2025 | ransomware_live | — |
| Adore Children and Family Services | October 22, 2025 | ransomware_live | — |
| DALCANS | October 19, 2025 | ransomware_live | — |
| Linxx Global Solutions | October 19, 2025 | ransomware_live | — |
| Imagicle | October 19, 2025 | ransomware_live | — |
| Cemtrex | October 13, 2025 | ransomware_live | — |
| EcoPetróleo | October 12, 2025 | ransomware_live | — |
| Design To Print | October 12, 2025 | ransomware_live | — |
| LA VOIE EXPRESS | October 12, 2025 | ransomware_live | — |
| Leprohon (Image !) | October 9, 2025 | ransomware_live | — |
| Lux Actuaries & Consultants | October 7, 2025 | ransomware_live | — |
| LGB | October 3, 2025 | ransomware_live | — |
| Leprohon | October 3, 2025 | ransomware_live | — |
| Future Generali | September 27, 2025 | ransomware_live | — |
| Insightin Health | September 26, 2025 | ransomware_live | — |
| Organon | September 26, 2025 | ransomware_live | — |
| Comcast | September 26, 2025 | ransomware_live | — |
| CCMC | September 23, 2025 | ransomware_live | — |
| Cariri | September 8, 2025 | ransomware_live | — |
| Rad-Solutions, LLC | September 6, 2025 | ransomware_live | — |
| TEAM GROUP | September 1, 2025 | ransomware_live | — |
| Level | September 1, 2025 | ransomware_live | — |
| Aldagi | August 26, 2025 | ransomware_live | — |
| Florarte | August 17, 2025 | ransomware_live | — |
| Expert E-commerce GmbH | August 17, 2025 | ransomware_live | — |
| PANSARD & ASSOCIES | August 6, 2025 | ransomware_live | — |
| White Coffee Corporation | July 30, 2025 | ransomware_live | — |
| Franklin Pierce Schools | July 30, 2025 | ransomware_live | — |
| Prosecuting Attorneys' Council of Georgia | July 3, 2025 | ransomware_live | — |
| Sermo | July 1, 2025 | ransomware_live | — |
| Southwest CARE Center | June 27, 2025 | ransomware_live | — |
| Sun Direct | June 13, 2025 | ransomware_live | — |
| R&W Engineering | June 13, 2025 | ransomware_live | — |
| San Jose Country Club | June 9, 2025 | ransomware_live | — |
| Hartwig Mechanical Inc | June 9, 2025 | ransomware_live | — |
| Bumfords | June 9, 2025 | ransomware_live | — |
| Town of North Providence Rhode Island corporate office | May 30, 2025 | ransomware_live | — |
| RE/MAX | May 27, 2025 | ransomware_live | — |
| Presort First Class | May 27, 2025 | ransomware_live | — |
| Bailey's | May 27, 2025 | ransomware_live | — |
| DSI Tech | May 14, 2025 | ransomware_live | — |
| DeVita & Associates, Inc. | May 13, 2025 | ransomware_live | — |
| Nottingham Construction | May 13, 2025 | ransomware_live | — |
| Trindel Insurance Fund | May 12, 2025 | ransomware_live | — |
| Russell Child Development Center | May 6, 2025 | ransomware_live | — |
| Lake Shore Paving | May 6, 2025 | ransomware_live | — |
| Weil Construction, Inc | May 1, 2025 | ransomware_live | — |
| Appalachian Regional Commission | April 24, 2025 | ransomware_live | — |
| Conditioned Air Corporation | April 24, 2025 | ransomware_live | — |
| Phelps United | April 22, 2025 | ransomware_live | — |
| Matthews Law | April 22, 2025 | ransomware_live | — |
| MRC de Maskinongé - district | April 19, 2025 | ransomware_live | — |
| Lithium Americas Nevada | April 16, 2025 | ransomware_live | — |
| Pawnee Heights Unified School District | April 14, 2025 | ransomware_live | — |
| Fall River Public Schools | April 12, 2025 | ransomware_live | — |
| National Association for Stock Car Auto Racing | April 8, 2025 | ransomware_live | — |
| Pulse Urgent Care | April 8, 2025 | ransomware_live | — |
| Bridgebank Limited | April 8, 2025 | ransomware_live | — |
| McFarland Commercial Insurance Services | April 8, 2025 | ransomware_live | — |
| FS Tool Corporation | April 1, 2025 | ransomware_live | — |
| Krypton Solutions | April 1, 2025 | ransomware_live | — |
| O'Shea Builders | March 28, 2025 | ransomware_live | — |
| Business Software Solutions | March 24, 2025 | ransomware_live | — |
| Family Health Services, Inc | March 24, 2025 | ransomware_live | — |
| AutoCanada | March 23, 2025 | ransomware_live | — |
| Advance Tapes International | March 21, 2025 | ransomware_live | — |
| Big Horn County School District #4 | March 19, 2025 | ransomware_live | — |
| J McCann & Co Ltd | March 19, 2025 | ransomware_live | — |
| Champions Group | March 19, 2025 | ransomware_live | — |
| Augusta Industrial Services, Inc. | March 17, 2025 | ransomware_live | — |
| National Safety Council | March 17, 2025 | ransomware_live | — |
| Coldwell Banker D’Ann Harper, REALTORS | March 16, 2025 | ransomware_live | — |
| SRP Companies (Second lock! + Company scam!) | March 16, 2025 | ransomware_live | — |
| Karen S Pouliot | March 13, 2025 | ransomware_live | — |
Page 1 of 6Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).