THREAT ACTOR
MEDUSA_
ActiveMedusa is a ransomware-as-a-service operation active since mid-2022, known for high-profile attacks against Toyota Financial Services, Minneapolis Public Schools, and several US municipalities. The group runs a public Telegram channel alongside its leak site, where it openly negotiates and pressures victims.
For Ransomnews editorial coverage of MEDUSA, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
537
Victims tracked
1 / 17
Active mirrors
2023-02-13
First listing
2026-04-26
Most recent
Victims by year
- 2026 28
- 2025 158
- 2024 208
- 2023 143
Leak site mirrors
17 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onionHuman Verify snapshot · 2024-03-01 16:06 -
xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onionsnapshot · 2026-07-09 12:30 -
dlmfciajg5s4vliyo5dhs5jyzhi2xr2fnkebul46lpf4xudtqiue4nid.onion503 Service Temporarily Unavailable snapshot · 2024-06-03 21:02 -
kyfiw76eol6ph2mq7pi5e5tdvce37bicddhai62qhdc5ja6jdchz4qqd.onionHuman Verify snapshot · 2024-07-30 04:02 -
62foekhv5humjrfwjdyd2dgextpbf5i7obguhwvfoghmu3nxpkmxlcid.onionHuman Verify snapshot · 2024-07-15 15:01 -
cx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd.onionsnapshot · 2025-11-12 09:05 -
hupxs7ps7md24kpz4lwsbra64abgxjx3pcc2wuca5ibawf2g5hlpfyqd.onionHuman Verify snapshot · 2024-06-13 05:02 -
osintcorp.netsnapshot · 2026-09-23 01:16 -
uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onionMedusa Chat snapshot · 2026-05-30 21:15 -
5ar4vuckm3k7osdlzskqkaqmqr4jjpmdikuotmlpkrbsxx7ard3xetyd.onionMedusa Chat snapshot · 2025-01-19 22:18 -
medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onionsnapshot · 2024-12-10 05:11 -
s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onionHuman Verify snapshot · 2026-02-05 05:03 -
medusakxxtp3uo7vusntvubnytaph4d3amxivbgg13hnhpk2nmus34yd.onionsnapshot · 2024-12-12 16:46 -
hm2hlugduzuxiya5bgrsewfxmrzxbmslvg3t42zdzsorcn2nyfbrh6qd.onion504 Gateway Time-out snapshot · 2025-02-13 10:23 -
7aqabivkwmpvjkyefonf3gpy5gsubopqni7kcirsrq3pflckxq5zz4id.onionHuman Verify snapshot · 2026-08-10 16:16 -
762a33bcwneu3i6m7g4unj7xoyvl3nolnbeqhm4jfap6d7uczj43mrqd.onionsnapshot · 2025-08-01 09:49 -
x4tqo27mrr5q5wobpuvw6rowmbclwe5h62etslydc6wnona73pmqwaid.onionsnapshot · 2025-08-01 09:51
Recent victims
The 50 most recent victims claimed by MEDUSA. Total in the index: 537.
| Date listed | Victim | Description |
|---|---|---|
| 2026-04-26 | Walman Optical | Walman Optical who is owned by well-known Company EssilorLuxottica is … |
| 2026-04-13 | Northeast Missouri Rural Telephone | NEMR provides high-speed and reliable internet services tailored for v… |
| 2026-04-02 | TouchSource | TouchSource delivers simple solutions for smart spaces that engage peo… |
| 2026-03-27 | Big Thumb | BigThumb IT Consultants provides a range of IT solutions including man… |
| 2026-03-25 | Live! Casino | Live! Casino is a premier gaming and entertainment company located in … |
| 2026-03-20 | University of Mississippi Medical Center (@ummcdata) | Leak Direct(https://t.me/ummcdata) The University of Mississippi Schoo… |
| 2026-03-17 | Bonanza Casino | Bonanza Casino is a vibrant entertainment venue in Reno that offers ga… |
| 2026-03-17 | Passaic County | Passaic County was created out of parts of Essex and Bergen Counties w… |
| 2026-03-17 | Cape May County | Cape May County Government is the official governing body of Cape May … |
| 2026-03-17 | Lehigh Carbon Community College | Lehigh Carbon Community College provides affordable, quality education… |
| 2026-03-12 | University of Mississippi Medical Center | The University of Mississippi School of Medicine (UMSOM) is the medica… |
| 2026-03-11 | Chartre Consulting | Chartre Consulting is a U.S.–based professional services and managemen… |
| 2026-03-11 | ToolpartsPro | ToolpartsPro specializes in providing a vast inventory of genuine OEM … |
| 2026-03-11 | AMEVIDA | AMEVIDA is one of the largest owner-managed companies in the German ca… |
| 2026-03-11 | Internation Planning Group | IPG has served clients residing in multiple Asian countries including … |
| 2026-03-11 | Shaft Drillers International | Shaft Drillers International is a U.S.-based construction and drilling… |
| 2026-03-11 | Acme | Acme Truck Line, Inc. (from www.acmetruck.com) is a U.S. transportatio… |
| 2026-03-11 | Frauenshuh | Frauenshuh Commercial Real Estate has been a leader in the commercial … |
| 2026-02-24 | (Begging Poors) Resource Corporation of America | (The company begged us for a long time with several ways to remove the… |
| 2026-02-20 | Colonial Van Lines | Colonial Van Lines is a U.S.-based long-distance moving and relocation… |
| 2026-02-20 | RTC | RTC (rtc.com) is a global retail solutions and merchandising company t… |
| 2026-02-20 | Aramsco | Aramsco is a U.S.-based distributor of professional cleaning, restorat… |
| 2026-02-17 | MESA Products | MESA Products is a U.S.-based industrial company that supplies cathodi… |
| 2026-02-10 | Grandview Family Medicine | Grandview Family Medicine is a healthcare provider offering a range of… |
| 2026-02-03 | Balloons Everywhere | Balloons.com is a wholesale distributor specializing in a wide range o… |
| 2026-02-03 | South Hays Fire Department | Hays County Emergency Services District 3 provides essential fire prev… |
| 2026-02-03 | Comune di Battipaglia | The Comune di Battipaglia is the official municipal government of Batt… |
| 2026-01-06 | Resource Corporation of America | Resource Corporation of America specializes in converting hospitals' a… |
| 2025-12-30 | JBS | JBS is a regional, public, nonprofit corporation established under Act… |
| 2025-12-19 | Concord Academy | Concord Academy is a specialized educational institution that serves s… |
| 2025-12-19 | Thunder Bay Counselling | Thunder Bay Counselling is a leading provider of personal and workplac… |
| 2025-12-19 | Sampoerna Agro | Founded in 1993 and headquartered in South Sumatra, Indonesia, PT Samp… |
| 2025-12-19 | Shamrock Technologies | Founded in 1941, Shamrock Technologies is a global provider of microni… |
| 2025-12-19 | Callipo Group | Callipo Group has been producing high-quality tuna and fish preserves … |
| 2025-11-25 | Universidade Municipal de São Caetano | USCS offers a diverse range of educational programs including in-perso… |
| 2025-11-25 | WR Comercial | WR Comercial helps businesses find great staff for important jobs like… |
| 2025-11-18 | Clackamas Community College | Clackamas Community College offers a variety of academic programs incl… |
| 2025-11-18 | PT Kalimantan Prima Persada | PT Kalimantan Prima Persada (KPP) is a subsidiary of PT Pamapersada Nu… |
| 2025-11-18 | Atrium Living Centers | Atrium Living Centers is a 100% employee-owned company providing skill… |
| 2025-11-18 | General Distributing | General Distributing Co is a company that operates in the Convenience … |
| 2025-11-18 | FDC Interiors | FDC / Interiors specializes in creating exceptional and luxurious spac… |
| 2025-11-18 | MFE Formwork Technology | MFE Formwork Technology is a global leader in aluminium formwork solut… |
| 2025-11-18 | Nationwide Legal LLC | Nationwide Legal LLC is a leading litigation support and legal service… |
| 2025-11-05 | LaRosa’s Pizzeria | LaRosa’s Pizzeria is a family-owned pizza restaurant chain founded in … |
| 2025-11-05 | Oscars Group | Oscars Group is a prominent hospitality collective in New South Wales,… |
| 2025-10-29 | Simon Property Group | Simon Property Group is a leading real estate investment trust (REIT) … |
| 2025-10-25 | Imagicle | Founded in 2010, Imagicle is head-quartered in Italy and has a fully o… |
| 2025-10-25 | Linxx Global Solutions | Linxx Global Solutions is a leading provider of mission-critical suppo… |
| 2025-10-25 | DALCANS | Otherwise, DALCANS will not make any exchange or refund of products or… |
| 2025-10-25 | Adore Children and Family Services | Adore Children and Family Services is a foster care agency dedicated t… |
CONFIRMED ATTACKS
Medusa confirmed attacks: 161 verified incidents
Ransomnews has verified 161 Medusa incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from February 2023 to March 2026. United States accounts for 100 of them (62%), with victims recorded in 30 countries in total. The most affected sector is healthcare, at 38 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 24; the outcome is unrecorded in the remaining 137. Where a figure was disclosed (68 cases), these incidents account for 6,092,190 exposed records.
161Verified incidents
30Countries
2023–2026Active range
0%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Medusa incidents (100 most recent of 161)
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| March 2026 | TouchSource, LLC | Technology | Colorado, United States | — | Unknown | Source |
| March 2026 | Passaic County | Government | New Jersey, United States | — | No | Source |
| March 2026 | Lehigh Carbon Community College | Education | Pennsylvania, United States | — | Unknown | Source |
| February 2026 | Little Bonanza, Inc. DBA Bonanza Casino | Other | Nevada, United States | — | Unknown | Source |
| February 2026 | MESA Products | Manufacturing | Oklahoma, United States | 991 | Unknown | Source |
| February 2026 | ACME Truck Line, Inc. | Transportation | Louisiana, United States | 21,799 | Unknown | Source |
| February 2026 | University of Mississippi Medical Center | Healthcare | Mississippi, United States | — | No | Source |
| February 2026 | Comune di Battipaglia | Government | Battipaglia, Italy | — | Unknown | Source |
| December 2025 | Resource Corporation of America | Healthcare | Texas, United States | 501 | Unknown | Source |
| November 2025 | Jefferson Blount St. Clair Mental Health Authority (JBS Mental Health Authority) | Healthcare | Alabama, United States | 30,434 | Unknown | Source |
| October 2025 | Atrium Centers, Inc. | Healthcare | Ohio, United States | — | Unknown | Source |
| October 2025 | Clackamas Community College | Education | Oregon, United States | 33,381 | Unknown | Source |
| September 2025 | Insightin Health | Healthcare | Maryland, United States | 1,144,686 | Unknown | Source |
| September 2025 | Generali Central Insurance Company Limited | Finance | Mumbai, India | — | Unknown | Source |
| September 2025 | L.G. Balakrishnan & Bros. Ltd. | Manufacturing | Coimbatore, India | — | Unknown | Source |
| September 2025 | Caribbean Industrial Research Institute | Government | St. Augustine, Trinidad and Tobago | — | Unknown | Source |
| June 2025 | Southwest Care Center (SCC) | Healthcare | New Mexico, United States | — | Unknown | Source |
| June 2025 | Franklin Pierce Schools | Education | Washington, United States | — | Unknown | Source |
| May 2025 | Town of North Providence | Government | Rhode Island, United States | 1,804 | Unknown | Source |
| April 2025 | Lithium Americas Corp. | Other | Vancouver, Canada | — | Unknown | Source |
| April 2025 | Appalachian Regional Commission | Government | District of Columbia, United States | 937 | Unknown | Source |
| April 2025 | Fall River Public Schools | Education | Massachusetts, United States | — | Unknown | Source |
| March 2025 | Docs Medical Group, Inc. dba Pulse Urgent Care Center | Healthcare | California, United States | 4,035 | Unknown | Source |
| March 2025 | National Association for Stock Car Auto Racing, LLC (NASCAR) | Other | Florida, United States | — | Unknown | Source |
| March 2025 | MRC de Maskinongé | Government | Louiseville, Canada | — | Unknown | Source |
| February 2025 | Karen S. Pouliot, CPA, P.A | Finance | Maryland, United States | — | Unknown | Source |
| February 2025 | Cache Valley Ear, Nose & Throat (CVENT) | Healthcare | Utah, United States | 26,469 | Unknown | Source |
| February 2025 | Heartland Health Center | Healthcare | Nebraska, United States | 43,728 | Unknown | Source |
| February 2025 | Strategic Retail Partners | Retail | Colorado, United States | 4,097 | Unknown | Source |
| February 2025 | Friendship House, Inc. | Healthcare | Nebraska, United States | 501 | Unknown | Source |
| February 2025 | Central District Health Department | Government | Nebraska, United States | — | Unknown | Source |
| February 2025 | Bell Ambulance | Healthcare | Wisconsin, United States | 237,830 | Unknown | Source |
| February 2025 | Laurens County School District 56 | Education | South Carolina, United States | — | Unknown | Source |
| February 2025 | CPI Books UK | Manufacturing | Croydon, United Kingdom | — | Unknown | Source |
| February 2025 | HCRG Care Group | Healthcare | Runcorn, United Kingdom | — | Unknown | Source |
| January 2025 | Village of Mundelein (Mundelein Park & Recreation District) | Government | Illinois, United States | 7,792 | Unknown | Source |
| January 2025 | Highlands Oncology Group PA | Healthcare | Arkansas, United States | 113,575 | Unknown | Source |
| January 2025 | Prestige Maintenance USA | Service | Texas, United States | 65,452 | Unknown | Source |
| January 2025 | Family Health Services, Inc. | Healthcare | Nebraska, United States | 4,040 | Unknown | Source |
| January 2025 | Rural Health Services, Inc. | Healthcare | South Carolina, United States | 36,542 | Unknown | Source |
| January 2025 | Greenwich Medical Spa | Other | Connecticut, United States | — | Unknown | Source |
| January 2025 | SimonMed Imaging | Healthcare | Arizona, United States | 1,275,669 | Unknown | Source |
| January 2025 | Natures Organics Pty Ltd | Manufacturing | Ferntree Gully, Australia | — | Unknown | Source |
| January 2025 | Hospital El Cruce | Healthcare | Buenos Aires, Argentina | — | Unknown | Source |
| January 2025 | Gateshead Council | Government | Gateshead, United Kingdom | — | Unknown | Source |
| December 2024 | Broker Educational Sales & Training, Inc. (B.E.S.T.) | Finance | Florida, United States | — | Unknown | Source |
| December 2024 | Albion College | Education | Michigan, United States | 6,930 | Unknown | Source |
| November 2024 | Robert H Clarkson Insurance Agency LLC | Finance | Kentucky, United States | 41,043 | Unknown | Source |
| November 2024 | Brodsky Renehan Pearlstein & Bouquet Chartered | Legal | Maryland, United States | 2,566 | Unknown | Source |
| November 2024 | Westfield Fire District | Government | Connecticut, United States | — | Unknown | Source |
| November 2024 | North Los Angeles County Regional Center | Healthcare | California, United States | 500 | Unknown | Source |
| November 2024 | Ainsworth Game Technology Limited | Technology | Newington, Australia | — | Unknown | Source |
| November 2024 | International University of Sarajevo | Education | Ilidža, Bosnia and Herzegovina | — | Unknown | Source |
| November 2024 | Lojas Marisa | Retail | São Paulo, Brazil | — | Unknown | Source |
| October 2024 | McMillan Electric Company | Manufacturing | Wisconsin, United States | 6,162 | Unknown | Source |
| September 2024 | System Pavers | Construction | California, United States | 5,232 | Unknown | Source |
| September 2024 | Hospital Episcopal San Lucas | Healthcare | Ponce, Puerto Rico | — | Unknown | Source |
| September 2024 | AZPIRED | Service | Cebu City, Philippines | — | Unknown | Source |
| September 2024 | Bell Data, Inc. | Technology | Tokyo, Japan | 47,359 | Unknown | Source |
| September 2024 | Compass Group Australia | Food and Beverage | McMahons Point, Australia | — | Unknown | Source |
| September 2024 | Compass Group Australia | Food and Beverage | McMahons Point, Australia | — | Unknown | Source |
| September 2024 | Providence Public Schools | Education | Rhode Island, United States | — | No | Source |
| September 2024 | Grupo Cortefiel (Tendam) | Retail | Madrid, Spain | — | Unknown | Source |
| August 2024 | Albany College of Pharmacy and Health Sciences | Education | New York, United States | 28,600 | Unknown | Source |
| July 2024 | Saint Thomas Aquinas High School | Education | Florida, United States | 37,064 | Unknown | Source |
| July 2024 | Gentlemen Group GmbH | Technology | Falkensee, Germany | — | Unknown | Source |
| July 2024 | Globes | Other | Rishon LeZion, Israel | — | Unknown | Source |
| July 2024 | Harry Perkins Institute of Medical Research | Healthcare | Nedlands, Australia | — | Unknown | Source |
| July 2024 | ValeCard | Finance | Minas Gerias, Brazil | — | Unknown | Source |
| July 2024 | Royal Brighton Yacht Club | Other | Brighton, Australia | — | Unknown | Source |
| July 2024 | Viasat Telematics | Technology | Madrid, Spain | — | Unknown | Source |
| June 2024 | Farmatodo | Healthcare | Barquisimeto, Venezuela | — | Unknown | Source |
| June 2024 | Tri-City College Prep High School | Education | Arizona, United States | — | Unknown | Source |
| June 2024 | Olympus Group | Manufacturing | Wisconsin, United States | — | Unknown | Source |
| June 2024 | Fitzgerald, DePietro & Wojnas CPAs, P.C | Finance | New York, United States | 13,044 | Unknown | Source |
| June 2024 | Vivara | Retail | Guara, Brazil | — | Unknown | Source |
| June 2024 | Radiosurgery New York | Healthcare | New York, United States | — | Unknown | Source |
| June 2024 | Victoria Racing Club | Other | Flemington, Australia | — | Unknown | Source |
| May 2024 | Colonial Surety Company | Finance | New Jersey, United States | — | Unknown | Source |
| May 2024 | Brick Court Chambers | Legal | London, United Kingdom | — | Unknown | Source |
| May 2024 | Elm Grove Village | Government | Wisconsin, United States | — | Unknown | Source |
| May 2024 | City of St. Helena | Government | California, United States | 975 | No | Source |
| May 2024 | County Connection | Government | California, United States | — | Unknown | Source |
| April 2024 | Rairdon Automotive Group | Retail | Washington, United States | 2,301 | Unknown | Source |
| April 2024 | Northeast Ohio Neighborhood Health Services, Inc. | Healthcare | Ohio, United States | — | Unknown | Source |
| April 2024 | Paducah Dermatology PLLC | Healthcare | Kentucky, United States | — | Unknown | Source |
| April 2024 | Summit Pathology and Summit Pathology Laboratories, Inc. | Healthcare | Colorado, United States | 1,813,538 | Unknown | Source |
| April 2024 | Autobell Car Wash, Inc. | Service | North Carolina, United States | 52,714 | Unknown | Source |
| April 2024 | Sutton Dental Arts, P.C. | Healthcare | Oregon, United States | 4,109 | Unknown | Source |
| April 2024 | Council of Fashion Designers of America, Inc. | Other | New York, United States | — | Unknown | Source |
| April 2024 | Woodfords Family Services | Healthcare | Maine, United States | 41,984 | Unknown | Source |
| April 2024 | John R Wood Christie’s International Real Estate | Service | Florida, United States | 1,172 | Unknown | Source |
| April 2024 | Comité Jeunesse de l'ORIIM/L | Healthcare | Montreal, Canada | — | Unknown | Source |
| April 2024 | Solano County Library | Government | California, United States | 150 | No | Source |
| March 2024 | Williams County Abstract Company | Service | North Dakota, United States | 635 | Unknown | Source |
| March 2024 | JVCKENWOOD Optical Electronics (Thailand) Co., Ltd. (JVC Kenwood Co, Ltd.) | Technology | Nong Bua Sala, Thailand | — | Unknown | Source |
| March 2024 | Anders Group, LLC | Service | Texas, United States | 3,797 | Unknown | Source |
| March 2024 | Lewis Brothers Bakeries, Inc. | Food and Beverage | Indiana, United States | 13,501 | Unknown | Source |
| March 2024 | Lee University | Education | Tennessee, United States | 136,928 | Unknown | Source |
| March 2024 | Kenneth Young Center | Healthcare | Illinois, United States | 850 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Medusa's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.