Abv listed on MedusaLocker leak site following alleged data breach

• Ransomware group: medusalocker
• Country: Bulgaria
• Announcement date: September 23, 2026

The threat actor known as MedusaLocker has listed the Bulgarian organization Abv on its dedicated leak site. According to the announcement made on September 23, 2026, the group claims to have successfully executed an attack against the entity, alleging that a data breach has occurred involving specific user information.

Details of the alleged incident

The announcement posted by the MedusaLocker group states that the organization targeted is based in Sofia, Bulgaria. The threat actor alleges that the breach resulted in the exfiltration of a specific set of data. While the group has made this public claim, it is important to note that information regarding this specific group remains limited in the public domain, making it difficult to ascertain their typical methods or full operational scope.

In many modern ransomware campaigns, threat actors employ a strategy known as double extortion. In this scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption phase. The threat of leaking this stolen information on a public leak site serves as additional leverage to pressure the victim into paying a ransom. By publishing a victim's name, the attackers aim to damage the organization's reputation and create legal or regulatory pressure.

Regarding the evidence provided by the attackers, the announcement includes a screenshot. However, the provided image displays only a browser verification page. Consequently, there is no visual evidence available in the public listing to confirm the contents or the authenticity of the leaked data.

Data involved in the claim

The MedusaLocker group claims that the following data types have been compromised during the alleged attack:

• Email addresses

The claim specifies that the volume of compromised information consists of 583 email addresses. No further details regarding the specific file counts, the total size of the data, or the specific ransom demand have been provided by the group in their announcement.

About Abv

Abv.bg is a popular free email service and web portal based in Bulgaria. Operated by Netinfo, the platform provides news, email services, and various digital content to its user base.

Risk assessment and defensive implications

The alleged exfiltration of email addresses poses significant secondary risks to the organization and its users. Even if the volume of data is relatively small, such information can be utilized by malicious actors to launch targeted phishing campaigns or social engineering attempts. These attacks often aim to deceive users into revealing credentials or installing malware by appearing to come from a legitimate source.

Because the organization operates within Bulgaria, this incident may trigger specific legal obligations. Under the EU General Data Protection Regulation (GDPR), organizations are often subject to strict data breach notification requirements when personal information is compromised. Failure to comply with these regulations can result in significant scrutiny from regulatory bodies.

While the limited scope of the claimed data suggests the incident might be narrow in scale, organizations should never overlook secondary risks. To mitigate potential fallout, it is often advisable for organizations facing such claims to initiate security audits and implement password resets for the affected accounts. Maintaining robust monitoring and verifying the integrity of user accounts are standard defensive steps to prevent further exploitation following an initial breach.