DSI Tech listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: United States
• Sector: Technology
• Announcement date: May 18, 2025

Medusa claims data breach against DSI Tech

The Medusa ransomware group has listed 399.10 GB of data, which they claim belongs to DSI Tech, on their dedicated leak site. This announcement, made on May 18, 2025, follows a purported cyberattack targeting the organization. The threat actor group is utilizing its established leak site infrastructure to exert pressure on the victim by threatening the public release of sensitive information.

According to the claims made by the Medusa group, the ransomware attack against DSI Tech was conducted on May 14, 2025. In conjunction with the data theft, the group is reportedly demanding a ransom payment of 400,000 USD to prevent the further dissemination of the stolen information. This pattern of behavior is consistent with the group's operational history, as they have been active since 2021.

Details of the alleged data theft

The volume of data involved in this incident is stated to be 399.10 GB. While the total file count was not provided in the announcement, the group has shared screenshots intended to demonstrate the nature of the exfiltrated information. These samples suggest a variety of sensitive documents were compromised during the breach.

The specific types of data identified in the leaked samples include:

• Employee background check documents
• Payment details
• Contact information
• Service contracts

About DSI Tech

DSI Tech is a technology sector organization based in the United States. Founded in 1991, the company operates as an IT value-added reseller and service provider. Their expertise lies in providing industry vendor products and solutions. Additionally, the company is recognized as a minority-owned small business.

Analysis and potential risks

Based on the current situation, the Medusa group appears to be employing a double-extortion strategy. This tactic involves not only encrypting an organization's systems but also stealing sensitive data to threaten its public release. This method is designed to maximize pressure on the victim, as the threat of a data leak can cause significant reputational and legal damage even if the organization can restore its systems from backups.

The exposure of the identified data types poses several secondary risks. The inclusion of employee background checks and contact information creates a high risk for identity theft and targeted phishing attacks directed at both the organization's employees and its clients. Furthermore, because the organization operates within the technology sector, such an incident could potentially increase risks related to supply chain attacks, where a breach in one provider is used as a stepping stone to reach their customers.

Given that DSI Tech is based in the United States, the breach may trigger legal proceedings regarding data privacy violations under relevant state laws and federal regulations. Organizations facing similar threats often focus on robust data protection strategies, such as implementing strict access controls, maintaining offline backups, and conducting regular security audits to mitigate the impact of such incidents.