medusa
First seen January 11, 2023Active518 claimed victims
The claims below are reproduced as posted by medusa on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Portland Street Honda | March 13, 2025 | ransomware_live | — |
| CPI Books | March 6, 2025 | ransomware_live | — |
| Customer Management Systems | March 4, 2025 | ransomware_live | — |
| Bell Ambulance | March 2, 2025 | ransomware_live | — |
| City of Aurora | February 26, 2025 | ransomware_live | — |
| Kable Product Services | February 26, 2025 | ransomware_live | — |
| Friendship House | February 25, 2025 | ransomware_live | — |
| Mundelein Park & Recreation District | February 24, 2025 | ransomware_live | — |
| Laurens School District 56 | February 24, 2025 | ransomware_live | — |
| Heartland Health Center | February 24, 2025 | ransomware_live | — |
| Aurora Boardworks | February 24, 2025 | ransomware_live | — |
| Benton Police Department | February 21, 2025 | ransomware_live | — |
| G&S Electric LLC | February 21, 2025 | ransomware_live | — |
| Martin Energy Group Services | February 21, 2025 | ransomware_live | — |
| Metropolitan Borough of Gateshead | February 21, 2025 | ransomware_live | — |
| HCRG Care Group | February 18, 2025 | ransomware_live | — |
| Crager LaBorde | February 17, 2025 | ransomware_live | — |
| Robinson Family Dentistry | February 17, 2025 | ransomware_live | — |
| Central District Health Department | February 12, 2025 | ransomware_live | — |
| JP Express | February 12, 2025 | ransomware_live | — |
| Cache Valley ENT | February 12, 2025 | ransomware_live | — |
| SRP Companies | February 11, 2025 | ransomware_live | — |
| Paignton Zoo | February 11, 2025 | ransomware_live | — |
| Natures Organics | February 11, 2025 | ransomware_live | — |
| MEDES College | February 10, 2025 | ransomware_live | — |
| Brockway Hair Design | February 10, 2025 | ransomware_live | — |
| Greenwich Medical Spa | February 10, 2025 | ransomware_live | — |
| Michael’s Hair Body Mind | February 10, 2025 | ransomware_live | — |
| Serenity Salon & Spa | February 10, 2025 | ransomware_live | — |
| PAD Aviation Technics GmbH | February 8, 2025 | ransomware_live | — |
| SimonMed Imaging | February 7, 2025 | ransomware_live | — |
| Adler Shine LLP | February 7, 2025 | ransomware_live | — |
| Rural Health Services | February 5, 2025 | ransomware_live | — |
| Glow Medi Spa | February 3, 2025 | ransomware_live | — |
| Grail Springs Retreat | February 3, 2025 | ransomware_live | — |
| Trimaco | January 31, 2025 | ransomware_live | — |
| Beauty Works Spa | January 31, 2025 | ransomware_live | — |
| Fayez Spa | January 31, 2025 | ransomware_live | — |
| ARDEX Australia | January 29, 2025 | ransomware_live | — |
| Philip Laney & Jolly | January 29, 2025 | ransomware_live | — |
| NG Automatics | January 29, 2025 | ransomware_live | — |
| Aden Footwear | January 29, 2025 | ransomware_live | — |
| English Braids | January 29, 2025 | ransomware_live | — |
| Addison Saws | January 29, 2025 | ransomware_live | — |
| Miles Industries | January 29, 2025 | ransomware_live | — |
| True World Foods | January 29, 2025 | ransomware_live | — |
| Hospital El Cruce | January 24, 2025 | ransomware_live | — |
| Chappell Schools | January 24, 2025 | ransomware_live | — |
| Berman Brothers | January 24, 2025 | ransomware_live | — |
| Dolmor Salon | January 23, 2025 | ransomware_live | — |
| Delta Fabrication and Machine, Inc | January 20, 2025 | ransomware_live | — |
| D & M Trim | January 20, 2025 | ransomware_live | — |
| Safco International Gen Trading | January 18, 2025 | ransomware_live | — |
| Prestige Maintenance USA | January 15, 2025 | ransomware_live | — |
| AVI Southeast | January 14, 2025 | ransomware_live | — |
| The Metropolitan Borough of Gateshead | January 14, 2025 | ransomware_live | — |
| Indus Towers | January 14, 2025 | ransomware_live | — |
| Rent-2-Own | January 9, 2025 | ransomware_live | — |
| Albion College | December 23, 2024 | ransomware_live | — |
| Broker Educational Sales & Training | December 19, 2024 | ransomware_live | — |
| Clarkson Insurance Group | December 13, 2024 | ransomware_live | — |
| North Los Angeles County Regional Center | December 12, 2024 | ransomware_live | — |
| Westfield Fire Department | December 12, 2024 | ransomware_live | — |
| Ainsworth Game Technology Limited | December 10, 2024 | ransomware_live | — |
| Bergerhof | December 10, 2024 | ransomware_live | — |
| Inmobiliaria Armas | December 10, 2024 | ransomware_live | — |
| Levicoff Law Firm, P.C | December 5, 2024 | ransomware_live | — |
| Brodsky Renehan Pearlstein & Bouquet, Chartered | December 5, 2024 | ransomware_live | — |
| Wiley Metal Fabricating | December 2, 2024 | ransomware_live | — |
| Down East Granite | December 2, 2024 | ransomware_live | — |
| Avico Spice | December 2, 2024 | ransomware_live | — |
| Perfection Plus Services Inc | November 25, 2024 | ransomware_live | — |
| Fancy Foods | November 25, 2024 | ransomware_live | — |
| Kela Health | November 25, 2024 | ransomware_live | — |
| RDS Electric | November 20, 2024 | ransomware_live | — |
| Maxeon | November 18, 2024 | ransomware_live | — |
| Manens-Tifs SpA | November 15, 2024 | ransomware_live | — |
| Logistical Software Ltd | November 15, 2024 | ransomware_live | — |
| LEGO Construction Co | November 15, 2024 | ransomware_live | — |
| Apple Electric Ltd | November 14, 2024 | ransomware_live | — |
| DynamicSystems | November 12, 2024 | ransomware_live | — |
| Marisa S.A | November 7, 2024 | ransomware_live | — |
| Howell Electric Inc | November 6, 2024 | ransomware_live | — |
| Jomar Electrical Contractors | November 6, 2024 | ransomware_live | — |
| McMillan Electric Company | November 5, 2024 | ransomware_live | — |
| Alliance Technical Group | November 5, 2024 | ransomware_live | — |
| Whitaker Construction Group | November 4, 2024 | ransomware_live | — |
| International University of Sarajevo | November 4, 2024 | ransomware_live | — |
| United Sleep Diagnostics | November 1, 2024 | ransomware_live | — |
| Spirit Lake Community School District | October 29, 2024 | ransomware_live | — |
| Island Coastal Services Ltd | October 25, 2024 | ransomware_live | — |
| Lakesight Technologies Information | October 25, 2024 | ransomware_live | — |
| American Medical Billing | October 22, 2024 | ransomware_live | — |
| American Mechanical, inc | October 22, 2024 | ransomware_live | — |
| Automha | October 22, 2024 | ransomware_live | — |
| SystemPavers | October 15, 2024 | ransomware_live | — |
| Inner City Education Foundation | October 15, 2024 | ransomware_live | — |
| Ultimate Removal | October 15, 2024 | ransomware_live | — |
| Ideker | October 15, 2024 | ransomware_live | — |
| Østerås Bygg | October 11, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).