Bendixengineering targeted by MedusaLocker ransomware group

• Ransomware group: MedusaLocker
• Country: United States
• Sector: Manufacturing
• Announcement date: January 9, 2025

MedusaLocker claims to have stolen data from Bendixengineering

The MedusaLocker ransomware group has listed data allegedly belonging to Bendixengineering on its leak site. This announcement, made on January 9, 2025, suggests that the organization may be facing a significant data exposure incident involving sensitive information.

According to the claims made by the threat actor, the attack took place on December 28, 2024. The group is currently demanding a ransom of 50,000 USD to prevent the release or to manage the stolen information. The threat actor has specified that the data in question spans the years 2016 through 2024. Furthermore, the group claims that the stolen data will be sold to a single buyer and that various options for generating profit from these specific files will be included as part of the deal.

Ransomware groups often utilize leak sites to pressure victims through a method known as double extortion. In this scenario, attackers do not just encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. By threatening to publish this data publicly, the attackers create a secondary layer of pressure, leveraging the potential for reputational damage, legal consequences, and loss of intellectual property to compel the victim to pay the ransom.

Data types identified in the leak site announcement

The screenshots provided in the announcement by the MedusaLocker group indicate that a variety of internal documents and communication files have been compromised. The information allegedly leaked includes several categories of sensitive data that could impact both the company and its stakeholders.

The following items were identified in the provided screenshots:

• Employee information
• Confidentiality agreements
• Customer email lists (.xls format)
• Outlook files (.msg)

The presence of such diverse file types, ranging from administrative agreements to direct communications and contact lists, suggests a broad reach within the targeted environment. For many organizations, the loss of Outlook files and email lists is particularly damaging as it provides a roadmap for future social engineering attempts.

About Bendixengineering

Bendixengineering is a California-based manufacturing company that provides precision machining and engineering solutions. The organization serves critical sectors, particularly the aerospace and defense industries, where precision and security are of paramount importance.

Analysis and implications of the incident

This incident suggests that sensitive corporate and personal data within Bendixengineering may be at risk of exposure. The allegedly leaked data could facilitate identity theft or targeted phishing attacks against the organization's employees and customers. Because the data includes employee information and confidentiality agreements, the personal privacy of staff members is directly at risk.

As the organization is based in the United States, legal proceedings under relevant state laws and federal data protection regulations may be triggered following the discovery of such a breach. The use of the double-extortion method by MedusaLocker may increase pressure on the organization and jeopardize operational continuity. It is important to note that information regarding the MedusaLocker group remains limited.

For organizations operating in high-stakes sectors like aerospace and defense, such incidents highlight the necessity of robust defensive postures. Common defensive steps for organizations include implementing multi-factor authentication (MFA) across all access points, maintaining offline or immutable backups to ensure recovery, and conducting regular employee training to recognize phishing attempts. Furthermore, strict network segmentation can help prevent threat actors from moving laterally from a single compromised workstation to sensitive file servers containing years of historical data.