ATIRG listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: France
• Sector: Healthcare
• Announcement date: October 27, 2025

Medusa ransomware group targets ATIRG

The Medusa ransomware group has listed the French Guiana-based healthcare organization ATIRG on its dedicated leak site. According to the announcement made on October 27, 2025, the threat actor group claims to have gained unauthorized access to the organization's systems, an attack they allege took place on October 22, 2025. The group is currently demanding a ransom payment of 100,000 USD to prevent the further disclosure of the data they claim to possess.

Ransomware attacks often follow a pattern where attackers encrypt an organization's files to disrupt operations and then steal sensitive information to use as leverage. This tactic is known as double extortion. In such scenarios, the threat actors use the threat of leaking private data on public leak sites to exert maximum financial pressure on the victim. These leak sites serve as a public gallery for stolen data, intended to shame the organization into paying the ransom to avoid reputational damage and legal consequences.

Details of the alleged data breach

The announcement by the Medusa group includes various file samples and screenshots that are alleged to be related to the operational processes of ATIRG. These visual proofs are intended to demonstrate the validity of the breach to the victim and the public. Based on the screenshots provided by the group, the leaked information appears to include highly sensitive medical and administrative documentation.

The specific types of data identified in the screenshots include:

• Patient treatment records
• Medical analysis results

The presence of such detailed medical information highlights the high-stakes nature of attacks targeting the healthcare sector. When sensitive medical records are compromised, the impact extends beyond immediate operational disruption to long-term risks for the individuals involved.

About ATIRG

ATIRG (Association pour le Traitement de l’Insuffisance Rénale en Guyane) is a non-profit healthcare organization located in French Guiana. The organization is dedicated to providing essential dialysis treatment and kidney care for patients suffering from chronic renal failure. Established in 1981, ATIRG plays a critical role in the regional healthcare infrastructure by operating specialized dialysis centers in Cayenne, Kourou, and Saint-Laurent-du-Maroni.

Risk assessment and sector implications

The alleged leak poses a high risk due to the potential exposure of sensitive patient data from a healthcare provider. The disclosure of such information may lead to violations of patient privacy and potential legal sanctions under GDPR. For healthcare organizations, the protection of patient data is not only a regulatory requirement but a fundamental component of patient safety and trust.

Given the Medusa group's known use of double-extortion tactics, the publication of this data could trigger significant secondary risks. These include the potential for identity theft and the execution of targeted phishing attacks against the individuals whose information has been exposed. Furthermore, such breaches can have negative impacts on the continuity of the organization's dialysis services, which could directly affect patient safety and the delivery of life-sustaining treatments.

The Medusa group is recognized as a Ransomware-as-a-Service (RaaS) entity that has been active since 2021. They utilize their leak site as a primary tool to exert financial pressure on their victims. For organizations in the healthcare sector, defending against such threats typically involves implementing robust security measures, such as multi-factor authentication, regular offline backups, and continuous monitoring of network traffic to detect unauthorized access early in the attack lifecycle.