Colegio María Inmaculada (CMI) listed on MedusaLocker leak site

• Ransomware group: MedusaLocker
• Country: Costa Rica
• Sector: Education
• Announcement date: May 5, 2026

The educational institution Colegio María Inmaculada (CMI), located in Costa Rica, has been listed on the leak site associated with the MedusaLocker ransomware group. According to an announcement made on May 5, 2026, the group claims to have successfully targeted the institution, marking a potential significant data breach for the organization.

The claims made by MedusaLocker

The MedusaLocker ransomware group claims that data belonging to Colegio María Inmaculada (CMI) has been exfiltrated. To support their claims, the group has published a file directory on their leak site that specifically references the institution's servers. While the group's activities have been noted, information regarding this specific group remains limited within the public domain.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on victims. These sites are used to host proof of the breach, often including screenshots or directory structures, to demonstrate that the attackers have indeed gained access to the target's internal environment. By publishing such information, threat actors aim to increase the likelihood of receiving a ransom payment through public exposure.

Details regarding the compromised data

Regarding the specific content of the breach, the details provided by the threat actor are currently limited. A screenshot shared on the leak site shows a folder structure named 'sorted,' but the exact nature of the compromised data has not been specified by the group. Consequently, the listing names no specific data types.

In many modern ransomware attacks, threat actors employ a strategy known as double extortion. In this scenario, the attackers do not merely encrypt the victim's files to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. This allows them to threaten the public release of the stolen data if the ransom demand is not met. This method is designed to maximize leverage over the victim by threatening reputational damage and legal consequences.

About Colegio María Inmaculada (CMI)

Colegio María Inmaculada (CMI) is a Catholic educational institution located in Moravia, Costa Rica. The institution provides essential educational services, specifically focusing on primary and secondary education levels for its students.

Analysis and sectoral implications

Given that the institution operates within the education sector, there is a high probability that the compromised data includes personal information belonging to both students and staff. Such a breach can lead to significant secondary risks for the individuals involved, including the potential for identity theft and the likelihood of being targeted by subsequent phishing attacks.

From a regulatory perspective, the disclosure of such sensitive information may create legal obligations for the institution under the data protection regulations of Costa Rica. Furthermore, the organization may face operational disruptions and potential reputational damage as a result of the incident. It is assessed that the institution may have been subjected to a ransom demand, consistent with the methods used by the MedusaLocker group.

Organizations operating in the education sector can take several defensive steps to mitigate these risks. Implementing robust data encryption for both data at rest and data in transit can help protect sensitive information. Additionally, maintaining regular, offline backups is a critical component of a resilient recovery strategy. Organizations should also focus on implementing strong access controls and multi-factor authentication to prevent unauthorized entry into their networks, and conduct regular security awareness training to help staff recognize and avoid phishing attempts.