CEAGESP / Netfeirasp listed on MedusaLocker ransomware leak site

• Ransomware group: MedusaLocker
• Country: Brazil
• Sector: Agriculture and Food Production
• Announcement date: May 5, 2026

MedusaLocker claims data breach at CEAGESP / Netfeirasp

The MedusaLocker ransomware group has published a leak announcement claiming to have obtained data belonging to the Brazilian organization CEAGESP / Netfeirasp. This listing appeared on the group's dedicated leak site, signaling a potential significant data breach for the entity involved.

The announcement includes a demo access area designed to showcase files that the threat actors allege were obtained from the organization's network. By providing this preview, the group aims to demonstrate the legitimacy of their claims. The group has indicated that it expects the organization to establish contact before the full data set is released to the public.

Details regarding the claimed data

The group has provided limited information regarding the specific nature of the leaked data. A screenshot included in the leak announcement displays a file manager interface containing various file directories. However, there is no detailed information regarding the specific nature of the leaked data, and the listing names no specific data types.

In such scenarios, ransomware groups often utilize double-extortion tactics. This method involves both encrypting the victim's systems to disrupt operations and stealing sensitive information to use as leverage. The threat of releasing stolen data on a public leak site is intended to pressure the victim into paying a ransom to prevent the exposure of their internal information.

About CEAGESP / Netfeirasp

CEAGESP is a state-owned company based in Sao Paulo, Brazil, that manages one of the largest food supply and wholesale market networks in the country. It plays a critical role in the distribution and logistics of agricultural products.

Potential impact and organizational risks

This incident may negatively impact the organization's operational continuity and commercial reputation. Depending on the content of the leaked data, legal sanctions under Brazil's LGPD regulations may arise if employee or customer information is exposed.

The risks associated with such breaches extend beyond immediate operational disruptions. Secondary risks may include the potential use of leaked data for identity theft or targeted phishing attacks. When sensitive information is exfiltrated, attackers can use it to craft highly convincing social engineering campaigns targeting specific individuals within or connected to the organization.

For organizations operating in critical sectors like agriculture and food production, maintaining robust cybersecurity posture is essential. General defensive steps for organizations facing such threats typically include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of phishing. Furthermore, ensuring compliance with regional data protection regulations, such as the LGPD in Brazil, is a vital component of managing the legal and reputational risks associated with data exposure.