Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
Medusa is a double-extortion ransomware-as-a-service operation active since 2021, documented by CISA/FBI as having affected over 300 victims, and distinct from the older MedusaLocker family and the Medusa Android trojan.
Medusa began around 2021 as a closed variant and later evolved into a RaaS. It conducts double-extortion attacks, exfiltrating data before encryption and threatening publication on its leak site. In March 2025 the FBI, CISA and MS-ISAC published advisory AA25-071A, documenting more than 300 victims across healthcare, education, legal, insurance, technology and manufacturing, based on activity investigated as recently as February 2025. FBI investigation stresses that this Medusa ransomware is unrelated to the older MedusaLocker family and to the Medusa mobile banking trojan.
Into 2026, activity attributed to Medusa deployment continued, including Microsoft reporting on Storm-1175 delivering Medusa in high-tempo operations against vulnerable web-facing systems.
Medusa's leak site has listed victims in Saudi Arabia, the UAE and Morocco among its international claims. These listings are extortion allegations and should be treated as claims, not confirmed breaches, unless independently verified.
Leak-site postings via ransomware.live — claimed by the group, not confirmed breaches. Metadata only. MENA Ransomware Watch →
| Date | Victim | Country | Sector |
|---|---|---|---|
| 2026-02-20 | Comune di Battipaglia | IT | Government & Defense |
| 2026-02-13 | MESA Products | US | Manufacturing |
| 2026-02-08 | Grandview Family Medicine | US | Healthcare |
| 2026-01-29 | South Hays Fire Department | US | Government & Defense |
| 2026-01-29 | Balloons Everywhere | US | Retail & E-Commerce |
| 2026-01-04 | Resource Corporation of America | US | Healthcare |
| 2025-12-23 | JBS | US | Healthcare |
| 2025-12-17 | Callipo Group | IT | Agriculture and Food Production |
| 2025-12-13 | Shamrock Technologies | US | Technology |
| 2025-12-13 | Sampoerna Agro | ID | Agriculture and Food Production |
| 2025-12-13 | Thunder Bay Counselling | CA | Government & Defense |
| 2025-11-28 | Concord Academy | US | Education |