Cariri listed on Medusa ransomware leak site with claims of data breach

• Ransomware group: Medusa
• Country: Trinidad & Tobago
• Sector: Education
• Announcement date: September 13, 2025

Medusa ransomware group targets Cariri

The Medusa ransomware group has listed the Trinidad and Tobago-based institution Cariri on its dedicated leak site. According to the announcement made on September 13, 2025, the threat actors claim to have successfully exfiltrated a significant volume of data from the organization. The group alleges that the breach occurred around September 8, 2025, and they are currently demanding a ransom of 100,000 USD to prevent the further release of the stolen information.

Ransomware attacks of this nature often involve a process known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data before the encryption occurs. The attackers then use the threat of leaking this stolen information on public forums or dedicated leak sites to pressure the victim into paying the ransom. If the ransom is not met, the group typically proceeds to publish the data, causing significant reputational and operational damage to the target.

Details of the alleged data theft

The Medusa group has provided specific details regarding the scale of the alleged intrusion. The threat actors claim that the total volume of the data stolen from Cariri amounts to 678.3 GB. While the total number of files involved has not been specified by the group, the announcement includes general information regarding the operations of the institution to demonstrate the legitimacy of their claims.

Based on screenshots provided by the attackers, the stolen information appears to include various sensitive documents. The data identified in the leak includes:

• Laboratory analysis reports
• Technical documents
• Corporate data

The presence of such diverse documentation suggests that the breach could impact multiple departments within the organization, ranging from technical research divisions to administrative and corporate management sectors.

About Cariri

CARIRI (Caribbean Industrial Research Institute) is a research and technology institute established by the Government of Trinidad and Tobago. The organization serves as a vital resource for both the public and private sectors by providing a wide array of specialized services. These include laboratory testing, engineering services, innovation support, and entrepreneurship development.

Furthermore, the institute offers research and development (R&D) capabilities, ICT consultancy, and technical training services. Given its role in providing technical and scientific support, the institution plays a significant part in the industrial and technological landscape of the region.

Potential impact and organizational risks

The alleged breach by the Medusa group carries substantial risks for Cariri. From an operational standpoint, such an attack can disrupt the continuity of the institution's research and engineering services. From a commercial and professional perspective, the breach may negatively impact the organization's reputation among its clients and partners in the public and private sectors.

The specific nature of the leaked data, which includes laboratory results and technical reports, introduces the risk of confidentiality breaches within the specific sectors that the institution serves. When technical research and laboratory findings are exposed, it can compromise the intellectual property and competitive advantages of the entities that rely on Cariri for R&D and testing.

Additionally, the institution may face legal and regulatory challenges regarding compliance with the laws and regulations of Trinidad and Tobago. Beyond the immediate data leak, organizations targeted by double-extortion tactics often face secondary risks, such as targeted phishing attempts where attackers use the stolen corporate information to craft highly convincing social engineering campaigns against employees or clients.

To mitigate such risks, organizations in the research and technology sector typically focus on robust data protection strategies. This includes implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data movement, and ensuring that sensitive technical documentation is encrypted both at rest and in transit. Regular security awareness training is also a critical component in defending against the secondary phishing threats that often follow a data breach.