Cooperativa Esercenti Farmacia Scrl listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Italy
• Sector: Healthcare
• Announcement date: October 27, 2025

Medusa ransomware group claims attack on Cooperativa Esercenti Farmacia Scrl

The Medusa ransomware group has officially listed the Italian organization Cooperativa Esercenti Farmacia Scrl on its dedicated leak site. According to the announcement, which was posted on October 27, 2025, the threat actors claim to have successfully breached the organization's systems. The group asserts that the attack took place on October 22, 2025, and they are currently demanding a ransom payment of 300,000 USD to prevent the release of stolen information.

Ransomware attacks of this nature typically follow a pattern where attackers infiltrate a network, exfiltrate sensitive data, and then encrypt the victim's files. In recent years, many groups have shifted toward a "double extortion" model. In this scenario, the attackers do not just lock the victim out of their systems; they also threaten to leak sensitive information on public forums or leak sites if the ransom is not paid. This increases the pressure on the victim, as the threat of a data leak can cause significant reputational and regulatory damage even if the organization can restore its systems from backups.

Details of the alleged breach and data theft

The Medusa group has provided several pieces of evidence to support their claim of a successful breach. The announcement includes various file samples and a visualization of a file tree that allegedly belongs to the organization's operational processes. Based on the screenshots provided by the group, the leaked information appears to include several types of sensitive records. These screenshots specifically display tables related to pharmacy operations and inventory lists, alongside a directory structure identified by the label 'farmacia_all'.

The specific types of data mentioned in the listing include:

• Pharmacy inventory records
• Operational data

While the group has shared these visual samples to demonstrate the scope of their access, the total size of the stolen data and the exact number of files involved have not been specified in the announcement.

About Cooperativa Esercenti Farmacia Scrl

Cooperativa Esercenti Farmacia Scrl is a cooperative based in Brescia, Italy. The organization serves as a support system for pharmacy operators within the region. Its primary mission involves providing essential services to pharmacists and related entities, such as facilitating communication, delivering institutional updates, and offering various operational resources to help manage their business activities.

Potential impact and industry implications

This alleged breach poses significant risks to the operational continuity and the commercial reputation of Cooperativa Esercenti Farmacia Scrl. Because the organization operates within the healthcare sector, the sensitivity of the leaked data may be heightened, which could potentially lead to regulatory sanctions. Furthermore, as the organization is based in Italy, the leaked data may fall under the scope of the European Union's General Data Protection Regulation (GDPR), which imposes strict requirements on how personal and sensitive data must be protected and managed.

The use of double-extortion tactics by the Medusa group—a Ransomware-as-a-Service (RaaS) entity that has been active since 2021—means that the publication of this data could lead to further downstream attacks. These include identity theft or highly targeted phishing campaigns directed at the organization's employees and business partners. When attackers possess operational data and inventory lists, they can craft much more convincing social engineering attacks to further compromise the network or defraud partners.

For organizations operating in the healthcare and support services sectors, maintaining robust cybersecurity defenses is critical. Common defensive steps include implementing multi-factor authentication (MFA) across all remote access points, maintaining offline and immutable backups to ensure recovery, and conducting regular security awareness training to help employees recognize phishing attempts. Additionally, strict network segmentation can help prevent an attacker from moving laterally from a single workstation to sensitive operational directories.