medusa
First seen January 11, 2023Active518 claimed victims
The claims below are reproduced as posted by medusa on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| RAYAB Consulting Engineers | February 22, 2023 | ransomware_live | — |
| International Center of Photography | February 19, 2023 | ransomware_live | — |
| AP Emissions Technologies | February 17, 2023 | ransomware_live | — |
| Foamtec International | February 16, 2023 | ransomware_live | — |
| PetroChina Indonesia | February 15, 2023 | ransomware_live | — |
| Eureka Casino Resort | February 13, 2023 | ransomware_live | — |
| Tonga Communications | February 11, 2023 | ransomware_live | — |
| Diethelm Keller Aviation Pte Ltd | February 9, 2023 | ransomware_live | — |
| EnCom | February 3, 2023 | ransomware_live | — |
| PFA Systems | February 3, 2023 | ransomware_live | — |
| Elim Clinic | February 3, 2023 | ransomware_live | — |
| Elektro Richter | February 3, 2023 | ransomware_live | — |
| European Window | February 2, 2023 | ransomware_live | — |
| Bank of Africa | January 30, 2023 | ransomware_live | — |
| EightPixelsSquare | January 25, 2023 | ransomware_live | — |
| Aglobis | January 20, 2023 | ransomware_live | — |
| Integerity Tax | January 11, 2023 | ransomware_live | — |
| Grace Church International | January 11, 2023 | ransomware_live | — |
← NewerPage 6 of 6
Claim data from ransomware.live and RansomLook (CC BY 4.0).