medusa
First seen January 11, 2023Active518 claimed victims
The claims below are reproduced as posted by medusa on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| EHPAD | October 23, 2023 | ransomware_live | — |
| Safpro | October 23, 2023 | ransomware_live | — |
| Believe Productions | October 16, 2023 | ransomware_live | — |
| Symposia Organizzazione Congressi S.R.L | October 16, 2023 | ransomware_live | — |
| Global Product Sales | October 16, 2023 | ransomware_live | — |
| EDB | October 16, 2023 | ransomware_live | — |
| ATI Traduction | October 16, 2023 | ransomware_live | — |
| ZOUARY & Associés | October 12, 2023 | ransomware_live | — |
| SIMTA | October 12, 2023 | ransomware_live | — |
| Evasión | October 12, 2023 | ransomware_live | — |
| Neodata | October 12, 2023 | ransomware_live | — |
| Agència Catalana de Notícies (ACN) | October 6, 2023 | ransomware_live | — |
| Somagic | October 3, 2023 | ransomware_live | — |
| Karam Chand Thapar & Bros Coal Sales | October 2, 2023 | ransomware_live | — |
| Windak | October 2, 2023 | ransomware_live | — |
| LANDSTAR POWER ONTARIO INC | September 26, 2023 | ransomware_live | — |
| Acoustic Center | September 25, 2023 | ransomware_live | — |
| Philippine Health Insurance | September 23, 2023 | ransomware_live | — |
| Franktronics, Inc | September 23, 2023 | ransomware_live | — |
| Gulf American Lines | September 20, 2023 | ransomware_live | — |
| Chait | September 20, 2023 | ransomware_live | — |
| Auckland Transport | September 18, 2023 | ransomware_live | — |
| Steripharma | September 11, 2023 | ransomware_live | — |
| Wave Hill | September 11, 2023 | ransomware_live | — |
| Jules B | September 4, 2023 | ransomware_live | — |
| Betton France | September 4, 2023 | ransomware_live | — |
| Skynet | August 30, 2023 | ransomware_live | — |
| Aranui Cruises | August 30, 2023 | ransomware_live | — |
| Axis Elevators | August 25, 2023 | ransomware_live | — |
| Durham Fasteners | August 25, 2023 | ransomware_live | — |
| LEN Italia | August 25, 2023 | ransomware_live | — |
| Sartrouville France | August 19, 2023 | ransomware_live | — |
| The International Civil Defense Organization | August 19, 2023 | ransomware_live | — |
| Novi Pazar put ad | August 19, 2023 | ransomware_live | — |
| Postel SpA | August 15, 2023 | ransomware_live | — |
| Borets (Levare.com) | August 14, 2023 | ransomware_live | — |
| CB Energy Australlia | August 14, 2023 | ransomware_live | — |
| Emerson School District | August 8, 2023 | ransomware_live | — |
| St Landry Parish School Board | July 31, 2023 | ransomware_live | — |
| Ace Micromatic Group | July 31, 2023 | ransomware_live | — |
| The Sinbad Club | July 25, 2023 | ransomware_live | — |
| Cafe Britt | July 23, 2023 | ransomware_live | — |
| Sun Pain Management | July 23, 2023 | ransomware_live | — |
| Nini Collection Ltd (Nini's Jewels) | July 18, 2023 | ransomware_live | — |
| Health Springs Medical Center | July 18, 2023 | ransomware_live | — |
| DTD Express | July 18, 2023 | ransomware_live | — |
| Tracker de Colombia SAS | July 7, 2023 | ransomware_live | — |
| Yunus Emre Institute Turkey | July 4, 2023 | ransomware_live | — |
| Luna Hotels & Resorts | July 3, 2023 | ransomware_live | — |
| Mutuelle LMP | July 3, 2023 | ransomware_live | — |
| Universitas Matthiae Belii association | June 25, 2023 | ransomware_live | — |
| Real Estate Systems Integrator | June 25, 2023 | ransomware_live | — |
| Praxis Energy Agents | June 20, 2023 | ransomware_live | — |
| FHR Electric | June 19, 2023 | ransomware_live | — |
| Salem Community Schools | June 15, 2023 | ransomware_live | — |
| Comisión Nacional de Valores | June 11, 2023 | ransomware_live | — |
| GAE Construction | June 11, 2023 | ransomware_live | — |
| Kramer Enterprises | June 9, 2023 | ransomware_live | — |
| Tour Partner Group | June 7, 2023 | ransomware_live | — |
| Concremat constructions | June 5, 2023 | ransomware_live | — |
| Farmacias Los Hidalgos | June 5, 2023 | ransomware_live | — |
| BilgeAdam Software | May 29, 2023 | ransomware_live | — |
| Fiduagraria | May 27, 2023 | ransomware_live | — |
| Trabzonspor Football Club | May 24, 2023 | ransomware_live | — |
| Leland Campbell LLP law firm | May 23, 2023 | ransomware_live | — |
| Amaszonas S.A. | May 23, 2023 | ransomware_live | — |
| SIGMA | May 22, 2023 | ransomware_live | — |
| Loreto Normanhurst | May 22, 2023 | ransomware_live | — |
| Al Tamimi Law Firm | May 19, 2023 | ransomware_live | — |
| BAMSI | May 15, 2023 | ransomware_live | — |
| HostAfrica | May 13, 2023 | ransomware_live | — |
| Wallick Communities | May 12, 2023 | ransomware_live | — |
| Cooperativa de Ahorro y Crédito Ahorrocoop Ltda | May 10, 2023 | ransomware_live | — |
| Sonda (Duplicate with update) | May 5, 2023 | ransomware_live | — |
| The Crown Princess Mary Cancer Centre | May 4, 2023 | ransomware_live | — |
| Polat Yol Yap | May 2, 2023 | ransomware_live | — |
| Alto Calore Servizi S.p.A. | May 2, 2023 | ransomware_live | — |
| Bevan Group | April 26, 2023 | ransomware_live | — |
| Magnolia Care Center | April 25, 2023 | ransomware_live | — |
| Bentham & Holroyd Ltd | April 24, 2023 | ransomware_live | — |
| WestcoastSmile Dental Studio | April 23, 2023 | ransomware_live | — |
| Uniondale School District | April 17, 2023 | ransomware_live | — |
| Allimand, France | April 15, 2023 | ransomware_live | — |
| Scantibodies Laboratory, Inc. | April 10, 2023 | ransomware_live | — |
| Atlantic International University | April 7, 2023 | ransomware_live | — |
| Open University of Cyprus | April 6, 2023 | ransomware_live | — |
| Sonda | April 3, 2023 | ransomware_live | — |
| Arandell Corp | April 2, 2023 | ransomware_live | — |
| Gujarat Mineral | March 24, 2023 | ransomware_live | — |
| Atlas Security | March 21, 2023 | ransomware_live | — |
| Law Firm Vazquez Nava Consultores y Abogados, S.C | March 18, 2023 | ransomware_live | — |
| National Institute of Ocean Technology | March 16, 2023 | ransomware_live | — |
| LLPGroup | March 14, 2023 | ransomware_live | — |
| Bishop Luffa School | March 13, 2023 | ransomware_live | — |
| National Business Furniture | March 9, 2023 | ransomware_live | — |
| Garbarino SAICeI | March 9, 2023 | ransomware_live | — |
| Minneapolis Public Schools | March 7, 2023 | ransomware_live | — |
| The Institute of Space Technology | March 6, 2023 | ransomware_live | — |
| Kenya Airports Authority | March 1, 2023 | ransomware_live | — |
| Moose, Martin, Haynes & Lundy | February 22, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).