Aldagi listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Georgia
• Sector: Financial Services
• Announcement date: August 27, 2025

Medusa ransomware group targets Aldagi

The Medusa ransomware group has listed the Georgian insurance company Aldagi on its dedicated leak site. According to the announcement made on August 27, 2025, the threat actor group claims to have successfully exfiltrated a significant amount of data from the organization's systems.

This listing follows a purported unauthorized access to the company's network. The group claims that the intrusion into the corporate network occurred on August 26, 2025. By appearing on their leak site, the attackers are utilizing a common tactic used by modern ransomware operations to pressure victims into meeting their demands through the threat of public exposure.

Details of the alleged breach and ransom demand

The Medusa group has made several specific claims regarding the scope of the incident. According to the group's announcement, the total volume of data allegedly stolen from Aldagi is 300.8 GB. While the group has provided a specific size for the data breach, they have not provided a specific file count or a detailed breakdown of the individual files involved.

Regarding the content of the breach, the listing does not provide specific information regarding the nature of the leaked data. Furthermore, attempts to view the specific details via the provided screenshots indicate that the relevant page is currently inaccessible. Despite the lack of visible data samples, the group has issued a formal ransom demand. They are demanding a payment of 200,000 USD to prevent the publication of the stolen information on their platform.

About Aldagi

Aldagi is a prominent player in the Georgian financial services sector. Established in 1990, the company has grown to become one of the leading insurance providers in Georgia. They offer an extensive portfolio consisting of over 80 different products designed for both individual and corporate clients. Their service range includes health, life, auto, and property insurance. Notably, Aldagi holds the distinction of being the first company in the region to offer reinsurance services.

Potential impact and industry implications

The implications of this claim are significant, particularly given the nature of the organization's business. Because Aldagi operates within the insurance sector, the exposure of data could potentially involve sensitive personal and financial information belonging to their customers. Such a breach poses several risks to the organization and its clients.

The Medusa group typically employs double extortion tactics. This method involves two distinct layers of pressure: first, encrypting the victim's systems to disrupt business operations, and second, threatening to leak sensitive data to the public to force payment. This dual-threat approach increases the pressure on organizations to comply with ransom demands to avoid reputational damage and potential legal consequences under local data protection regulations.

Risks and defensive considerations

The potential misuse of stolen data is a primary concern in these scenarios. If the data is indeed leaked, it may be utilized by malicious actors for identity theft or as a foundation for highly targeted phishing campaigns against the company's clients. Such attacks can be difficult to detect and can cause long-term harm to the victims.

For organizations operating in the financial and insurance sectors, maintaining robust cybersecurity postures is essential. Common defensive strategies often include:

• Implementing strict access controls and multi-factor authentication to prevent unauthorized network entry.
• Maintaining regular, offline, and encrypted backups to mitigate the impact of encryption-based ransomware.
• Continuous monitoring of network traffic to detect anomalous data exfiltration patterns.
• Conducting regular security awareness training to help employees identify phishing attempts.

Information regarding the Medusa group remains limited, and the full extent of the impact on Aldagi remains to be determined as the situation develops.