medusa
First seen January 11, 2023Active518 claimed victims
The claims below are reproduced as posted by medusa on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Principle Cleaning Services | April 23, 2024 | ransomware_live | — |
| The Council of Fashion Designers of America | April 23, 2024 | ransomware_live | — |
| Ted Brown Music | April 20, 2024 | ransomware_live | — |
| NORTHEAST OHIO NEIGHBORHOOD HEALTH SERVICES (NEON) | April 18, 2024 | ransomware_live | — |
| Lee University | April 17, 2024 | ransomware_live | — |
| Thermodyn Corporation | April 15, 2024 | ransomware_live | — |
| Traverse City Area Public Schools | April 13, 2024 | ransomware_live | — |
| Novus International | April 12, 2024 | ransomware_live | — |
| Alliance Mercantile | April 12, 2024 | ransomware_live | — |
| Solano County Library | April 12, 2024 | ransomware_live | — |
| Williams County Abstract Company | April 9, 2024 | ransomware_live | — |
| John R. Wood Properties | April 8, 2024 | ransomware_live | — |
| Tarrant Appraisal District | April 6, 2024 | ransomware_live | — |
| Integration International | April 5, 2024 | ransomware_live | — |
| Rairdon Automotive Group | April 5, 2024 | ransomware_live | — |
| Domestic Violence Project, Inc | April 5, 2024 | ransomware_live | — |
| Paducah Dermatology | April 5, 2024 | ransomware_live | — |
| Sutton Dental Arts | April 3, 2024 | ransomware_live | — |
| Orientrose Contracts | April 3, 2024 | ransomware_live | — |
| East Baton Rouge Sheriff's Office | April 2, 2024 | ransomware_live | — |
| San Pasqual Band of Mission Indians | April 2, 2024 | ransomware_live | — |
| Williams County Abstract Company | March 29, 2024 | ransomware_live | — |
| PT Bank Pembangunan Daerah Banten Tbk | March 27, 2024 | ransomware_live | — |
| Impac Mortgage Holdings | March 23, 2024 | ransomware_live | — |
| Regina Dental Group | March 23, 2024 | ransomware_live | — |
| Henry County, Illinois | March 21, 2024 | ransomware_live | — |
| Suburban Surgical Care Specialists | March 20, 2024 | ransomware_live | — |
| Urban Strategies | March 19, 2024 | ransomware_live | — |
| Accipiter Capital Management, LLC | March 19, 2024 | ransomware_live | — |
| Romark Laboratories | March 17, 2024 | ransomware_live | — |
| Elior UK | March 16, 2024 | ransomware_live | — |
| Autorità di Sistema Portuale del Mar Tirreno Settentrionale It | March 16, 2024 | ransomware_live | — |
| Metzger Veterinary Services | March 15, 2024 | ransomware_live | — |
| Desco Steel | March 15, 2024 | ransomware_live | — |
| Kenneth Young Center | March 11, 2024 | ransomware_live | — |
| Denninger’s | March 8, 2024 | ransomware_live | — |
| US #1364 Federal Credit Union | March 6, 2024 | ransomware_live | — |
| American Renal Associates | March 6, 2024 | ransomware_live | — |
| JVCKENWOOD | March 6, 2024 | ransomware_live | — |
| Tocci Building Corporation | March 6, 2024 | ransomware_live | — |
| Haivision MCS | March 5, 2024 | ransomware_live | — |
| Veeco | March 4, 2024 | ransomware_live | — |
| Paul Davis Restoration | March 4, 2024 | ransomware_live | — |
| Chris Argiropoulos Professional | March 3, 2024 | ransomware_live | — |
| Eastern Rio Blanco Metropolitan | March 3, 2024 | ransomware_live | — |
| Centennial Law Group LLP | March 3, 2024 | ransomware_live | — |
| Sophiahemmet University | March 3, 2024 | ransomware_live | — |
| Prompt Financial Solutions | March 3, 2024 | ransomware_live | — |
| Stoney Creek Furniture | February 28, 2024 | ransomware_live | — |
| JS International | February 27, 2024 | ransomware_live | — |
| The Professional Liability Fund | February 26, 2024 | ransomware_live | — |
| Southwest Industrial Sales | February 26, 2024 | ransomware_live | — |
| Penn Cinema | February 26, 2024 | ransomware_live | — |
| Pressco Technology | February 23, 2024 | ransomware_live | — |
| Acorn | February 23, 2024 | ransomware_live | — |
| Bimbo Bakeries | February 17, 2024 | ransomware_live | — |
| The Chas. E. Phipps | February 16, 2024 | ransomware_live | — |
| Kadac Australia | February 12, 2024 | ransomware_live | — |
| Modern Kitchens | February 12, 2024 | ransomware_live | — |
| Amoskeag Network Consulting Group LLC | February 11, 2024 | ransomware_live | — |
| ArpuPlus | February 6, 2024 | ransomware_live | — |
| Digitel Venezuela | February 2, 2024 | ransomware_live | — |
| Galaxy Fireworks, Inc | January 31, 2024 | ransomware_live | — |
| Kansas City Area Transportation Authority | January 26, 2024 | ransomware_live | — |
| CloudFire Italy | January 25, 2024 | ransomware_live | — |
| Signature Performance Insurance | January 24, 2024 | ransomware_live | — |
| Richmond Fellowship Scotland | January 22, 2024 | ransomware_live | — |
| The Gainsborough Bath | January 22, 2024 | ransomware_live | — |
| Pozzi Italy | January 22, 2024 | ransomware_live | — |
| Waldner's | January 22, 2024 | ransomware_live | — |
| Stone, Avant & Daniels | January 17, 2024 | ransomware_live | — |
| Water For People | January 11, 2024 | ransomware_live | — |
| Limburg | January 11, 2024 | ransomware_live | — |
| Biomatrix LLC | December 17, 2023 | ransomware_live | — |
| ATCO Products Inc | December 17, 2023 | ransomware_live | — |
| The Glendale Unified School District | December 11, 2023 | ransomware_live | — |
| Hinsdale School District | December 11, 2023 | ransomware_live | — |
| Sagent | December 6, 2023 | ransomware_live | — |
| ACCU Reference Medical Lab | December 6, 2023 | ransomware_live | — |
| Campbell County Schools | December 6, 2023 | ransomware_live | — |
| Rosens Diversified Inc | December 5, 2023 | ransomware_live | — |
| Bowden Barlow Law PA | December 5, 2023 | ransomware_live | — |
| Great Valley School District | November 29, 2023 | ransomware_live | — |
| Chetu | November 29, 2023 | ransomware_live | — |
| Community Hospital | November 22, 2023 | ransomware_live | — |
| McCray & Withrow | November 17, 2023 | ransomware_live | — |
| CENTRE D'AUTO P.R.N. SALABERRY IN | November 17, 2023 | ransomware_live | — |
| Toyota Financial | November 16, 2023 | ransomware_live | — |
| Moneris Solutions | November 13, 2023 | ransomware_live | — |
| Hopewell Area School District | November 7, 2023 | ransomware_live | — |
| Canadian Psychological Association | November 5, 2023 | ransomware_live | — |
| Zon Beachside | November 5, 2023 | ransomware_live | — |
| Leaguers | November 5, 2023 | ransomware_live | — |
| Unimed Blumenau | November 5, 2023 | ransomware_live | — |
| Weidmann & Associates | November 5, 2023 | ransomware_live | — |
| Mount Carmel Care Center | October 31, 2023 | ransomware_live | — |
| Software Systems | October 31, 2023 | ransomware_live | — |
| Jockey Club | October 30, 2023 | ransomware_live | — |
| Native Counselling Services of Alberta | October 23, 2023 | ransomware_live | — |
| Beaver Lake Cree Nation | October 23, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).