Bandeirante Supermercados listed on MedusaLocker ransomware leak site

• Ransomware group: MedusaLocker
• Country: Brazil
• Sector: Retail & E-Commerce
• Announcement date: May 5, 2026

The MedusaLocker ransomware group has listed the Brazilian supermarket chain Bandeirante Supermercados on its dedicated leak site. According to the announcement made on May 5, 2026, the threat actors claim to have successfully compromised the institution's data, marking a new instance of targeted cyber extortion against the retail sector.

The claimed attack and event details

The threat actors behind the MedusaLocker group have published a listing claiming responsibility for the breach of Bandeirante Supermercados. In this announcement, the group alleges that they have gained unauthorized access to the institution's data. The listing specifically identifies the target as being based in Brazil and includes a directory structure intended for file sharing, which is a common tactic used by ransomware groups to demonstrate the scope of their intrusion.

Ransomware leak sites function as a platform for extortion, often employing a double extortion strategy. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to pressure the victim into paying a ransom. By publishing a listing or a directory, the group aims to increase the pressure on the victim by threatening to release the stolen data to the public or to specific stakeholders.

Information regarding the leaked data

At this stage, there is no detailed information regarding the specific content of the leaked data provided in the record or the associated screenshots. The listing does not specify the volume of data stolen or the total number of files involved. The only visible information regarding the contents is a directory structure named 'sorted/'.

• No specific data types have been identified in the listing.

About Bandeirante Supermercados

Bandeirante Supermercados is a supermarket chain based in Brazil. The organization operates within the retail sector, specifically focusing on the field of daily consumer goods and food retail.

Risk assessment and industry implications

This incident may pose significant risks to the operational continuity of Bandeirante Supermercados. Depending on the actual content of the leaked data, if employee or customer information has been exposed, the organization could face risks related to identity theft and targeted phishing attacks. Furthermore, the institution may face data breach notification obligations under Brazil's LGPD regulations.

Beyond the immediate technical impact, secondary risks include potential reputational damage following the publication of data and the possibility that supply chain partners could be indirectly affected by the disruption. For organizations in the retail and e-commerce sectors, such incidents highlight the importance of robust defensive measures. Common defensive steps include maintaining rigorous backup protocols, implementing multi-factor authentication, and ensuring continuous monitoring of network traffic to detect unauthorized access early.

Information regarding the MedusaLocker group remains limited in the public domain, making it difficult to attribute specific tactics or long-term objectives. However, the targeting of retail entities remains a consistent trend for various ransomware groups due to the critical nature of their operational uptime and the high volume of sensitive consumer data they manage.