medusa
First seen January 11, 2023Active518 claimed victims
The claims below are reproduced as posted by medusa on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Construction Systems inc | October 11, 2024 | ransomware_live | — |
| World Vision Perú | October 11, 2024 | ransomware_live | — |
| Arelance Group | October 7, 2024 | ransomware_live | — |
| Albany College of Pharmacy | October 7, 2024 | ransomware_live | — |
| Istrail | October 7, 2024 | ransomware_live | — |
| Emerson | October 1, 2024 | ransomware_live | — |
| Sub-Zero, Wolf, and Cove | September 30, 2024 | ransomware_live | — |
| Isola | September 30, 2024 | ransomware_live | — |
| Travel Alberta | September 30, 2024 | ransomware_live | — |
| BELL DATA, Inc | September 30, 2024 | ransomware_live | — |
| Røros Hotell | September 28, 2024 | ransomware_live | — |
| Xtera Communications | September 17, 2024 | ransomware_live | — |
| Providence Public School Department | September 16, 2024 | ransomware_live | — |
| Amerinational Community Services | September 16, 2024 | ransomware_live | — |
| TECHNOLOG S.r.l. | September 12, 2024 | ransomware_live | — |
| IP blue Software Solutions | September 12, 2024 | ransomware_live | — |
| Hairstore | September 11, 2024 | ransomware_live | — |
| Karakaya Group | September 10, 2024 | ransomware_live | — |
| Starr-Iva Water & Sewer District | September 10, 2024 | ransomware_live | — |
| Wilson & Lafleur | September 10, 2024 | ransomware_live | — |
| Fritzøe Engros | September 10, 2024 | ransomware_live | — |
| Grupo Cortefiel | September 7, 2024 | ransomware_live | — |
| Prosolit | September 7, 2024 | ransomware_live | — |
| America Voice | September 6, 2024 | ransomware_live | — |
| Micron Internet | September 5, 2024 | ransomware_live | — |
| AZPIRED | September 5, 2024 | ransomware_live | — |
| Hospital Episcopal San Lucas | September 4, 2024 | ransomware_live | — |
| Compass Group | September 3, 2024 | ransomware_live | — |
| Structural Concepts | September 3, 2024 | ransomware_live | — |
| Compass Group (2nd attack) | September 3, 2024 | ransomware_live | — |
| Shomof Group | September 2, 2024 | ransomware_live | — |
| Kingsport Imaging Systems | September 2, 2024 | ransomware_live | — |
| Percento Technologies Internationa | August 19, 2024 | ransomware_live | — |
| The Pyle Group | August 15, 2024 | ransomware_live | — |
| Ali Gohar | August 1, 2024 | ransomware_live | — |
| Camp Susque | August 1, 2024 | ransomware_live | — |
| St. Thomas Aquinas High School | July 30, 2024 | ransomware_live | — |
| Gentlemen Group GmbH | July 27, 2024 | ransomware_live | — |
| Vivara | July 24, 2024 | ransomware_live | — |
| Coffrage LD | July 23, 2024 | ransomware_live | — |
| Owens Valley Career Development Center | July 23, 2024 | ransomware_live | — |
| AA Munro Insurance | July 22, 2024 | ransomware_live | — |
| Globes | July 22, 2024 | ransomware_live | — |
| Jariet Technologies | July 16, 2024 | ransomware_live | — |
| H&H Group | July 16, 2024 | ransomware_live | — |
| Braum's | July 16, 2024 | ransomware_live | — |
| ValeCard | July 15, 2024 | ransomware_live | — |
| Royal Brighton Yacht Club | July 15, 2024 | ransomware_live | — |
| American Golf | July 12, 2024 | ransomware_live | — |
| Cedar Technologies | July 8, 2024 | ransomware_live | — |
| Viasat Group | July 7, 2024 | ransomware_live | — |
| Olympus Group | July 7, 2024 | ransomware_live | — |
| Viasat | July 7, 2024 | ransomware_live | — |
| Harry Perkins Institute of medical research | July 7, 2024 | ransomware_live | — |
| Strauss Brands | July 7, 2024 | ransomware_live | — |
| North Coast Petroleum | June 27, 2024 | ransomware_live | — |
| Ontario West and Bill Blaney Insurance Brokers | June 27, 2024 | ransomware_live | — |
| AJE | June 18, 2024 | ransomware_live | — |
| Fitzgerald, DePietro & Wojnas CPAs, P.C. | June 17, 2024 | ransomware_live | — |
| Tri-City College Prep High School | June 17, 2024 | ransomware_live | — |
| Victoria Racing Club | June 14, 2024 | ransomware_live | — |
| Farnell Packaging | June 11, 2024 | ransomware_live | — |
| Dynamo Electric | June 10, 2024 | ransomware_live | — |
| GEMCO Constructors | June 10, 2024 | ransomware_live | — |
| Women's Sports Foundation | June 4, 2024 | ransomware_live | — |
| Oracle Advisory Services | June 4, 2024 | ransomware_live | — |
| Inside Broadway | June 4, 2024 | ransomware_live | — |
| Radiosurgery New York | June 4, 2024 | ransomware_live | — |
| Mercy Drive Inc | June 4, 2024 | ransomware_live | — |
| Market Pioneer International Corp | June 4, 2024 | ransomware_live | — |
| IPPBX | June 4, 2024 | ransomware_live | — |
| Health People | June 4, 2024 | ransomware_live | — |
| St. Helena | May 31, 2024 | ransomware_live | — |
| Sems and Specials | May 30, 2024 | ransomware_live | — |
| Brownell Boat Stands & Equipment Company | May 27, 2024 | ransomware_live | — |
| Wichita County Mounted Patrol | May 27, 2024 | ransomware_live | — |
| Heras | May 20, 2024 | ransomware_live | — |
| International Modern Hospital | May 20, 2024 | ransomware_live | — |
| Aztec Services Group | May 20, 2024 | ransomware_live | — |
| Comwave | May 17, 2024 | ransomware_live | — |
| Elm Grove | May 17, 2024 | ransomware_live | — |
| County Connection | May 17, 2024 | ransomware_live | — |
| WEICON | May 17, 2024 | ransomware_live | — |
| Colonial Surety Company | May 14, 2024 | ransomware_live | — |
| Brick Court Chambers | May 12, 2024 | ransomware_live | — |
| National Metalwares, L.P | May 11, 2024 | ransomware_live | — |
| NITEK International LLC | May 11, 2024 | ransomware_live | — |
| Chemring Group | May 7, 2024 | ransomware_live | — |
| Autobell Car Wash, Inc | May 7, 2024 | ransomware_live | — |
| Merritt Properties, LLC | May 7, 2024 | ransomware_live | — |
| W.F. Whelan | May 6, 2024 | ransomware_live | — |
| Boyden | May 6, 2024 | ransomware_live | — |
| Patterson & Rothwell Ltd | May 6, 2024 | ransomware_live | — |
| One Toyota of Oakland | May 6, 2024 | ransomware_live | — |
| Macildowie Associates | May 4, 2024 | ransomware_live | — |
| Woodfords Family Services | April 30, 2024 | ransomware_live | — |
| MyoVision | April 30, 2024 | ransomware_live | — |
| S.A. Piazza & Associates | April 30, 2024 | ransomware_live | — |
| Lewis Brothers Bakeries | April 30, 2024 | ransomware_live | — |
| Anders Group | April 25, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).