Bell Ambulance listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: United States
• Sector: Healthcare
• Announcement date: March 2, 2025

The Medusa ransomware group has officially listed Bell Ambulance on its dedicated leak site. According to the group's announcement, the healthcare provider has been targeted in a cyberattack, with the threat actors claiming to have successfully exfiltrated a significant volume of corporate data.

Details of the Medusa claim

The threat actor, identified as the Medusa ransomware group, has added Bell Ambulance to its public leak site. In the announcement, the group alleges that it has acquired 219.50 GB of data belonging to the organization. This claim was made on March 2, 2025, which also matches the date the group claims the attack occurred.

As part of their extortion attempt, the Medusa group is demanding a ransom payment of 400,000 dollars. The threat actors have stated that this payment is required in exchange for not publishing the stolen information online. It is important to note that because the content of the provided screenshots cannot be independently verified, the full scope and accuracy of the leak rely solely on the claims made by the ransomware group.

Ransomware groups often utilize leak sites to apply pressure on their victims through a method known as double extortion. In this scenario, attackers do not just encrypt a victim's systems to disrupt operations; they also steal sensitive data beforehand. The threat of leaking this data publicly serves as a secondary lever to force the victim into paying the ransom, even if they have backups to restore their systems.

Data involvement and content

The exact nature and specific types of the leaked data have not been specified by the attackers. While the group has provided a screenshot as part of their announcement, the image contains only a verification page. This prevents any direct viewing of actual data samples, making it impossible to confirm the specific contents of the alleged breach.

The listing names no specific data types.

About Bell Ambulance

Bell Ambulance is a healthcare organization based in Milwaukee, Wisconsin. The company provides essential emergency medical transportation services for patients, operating around the clock to facilitate the transfer of patients with various medical conditions to healthcare institutions.

Implications and industry considerations

The claim made by the Medusa group suggests that the operational and patient data of a healthcare institution may be at risk. For organizations operating within the United States, such incidents may trigger specific notification obligations under HIPAA regulations. The sensitivity of the alleged data could potentially cause the institution to suffer significant reputational damage and face various legal proceedings.

Furthermore, the scale of the organization suggests that employee data may also be included in the leak, given that the institution has approximately 500 employees. If the data is eventually published, the Medusa group's double extortion method could lead to secondary threats, such as identity theft or highly targeted phishing attacks against the organization's patients and staff.

In the healthcare sector, protecting sensitive information is critical due to the high value of medical records on the dark web. Organizations in this sector typically focus on robust defensive measures to mitigate these risks, such as implementing strict access controls, maintaining comprehensive logging, and ensuring regular, offline backups. Additionally, continuous monitoring and employee training are standard practices used to defend against the initial stages of a ransomware deployment.