Expert E-commerce GmbH targeted by Medusa ransomware group

• Ransomware group: Medusa
• Country: Germany
• Sector: Technology
• Announcement date: August 20, 2025

Medusa ransomware group claims data breach at Expert E-commerce GmbH

The Medusa ransomware group has published an announcement on its leak site claiming to have stolen data belonging to Expert E-commerce GmbH. According to the group's post, the breach involves a significant volume of information, and the attackers have issued a ransom demand in response to the incident.

Details of the alleged attack and ransom demand

The Medusa group created a leak announcement regarding Expert E-commerce GmbH on August 17, 2025. Through this announcement, the group claims to have successfully obtained 114 GB of data from the company's network. This type of activity is common among modern ransomware operations, where threat actors target specific organizations to extract sensitive information for leverage.

In addition to the claim of data theft, the group has issued a specific ransom demand. The announcement includes a demand for 200,000 USD. Ransomware groups often use these public platforms to exert pressure on their victims, utilizing the threat of leaking sensitive information to coerce organizations into paying the requested amount.

Information regarding the leaked data

There is no detailed information regarding the specific content of the alleged leaked data in the screenshots provided by the group. However, the shared images contain various tables and record lists, suggesting the nature of the files obtained from the network.

About Expert E-commerce GmbH

Expert E-commerce GmbH is a German company that provides e-commerce services and online support solutions for specialist stores affiliated with the Expert SE group. Founded in 1999, the firm focuses on managing digital operations within the retail sector.

Impact and potential risks of the incident

This incident may create negative impacts on the company's operational processes. As a Germany-based company, the occurrence of such a leak may lead to legal sanctions and administrative fines under GDPR. The publication of the data may bring about secondary risks such as identity theft or targeted phishing attacks for the company's employees and customers. The Medusa group is known as an entity that employs double extortion tactics, which may increase the pressure on the organization. The company's supply chain partners may also be indirectly affected by this situation.

Double extortion is a tactic where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This method significantly increases the pressure on an organization, as paying the ransom to decrypt data does not guarantee that the stolen data will not be leaked or sold on the dark web. Such tactics force companies to deal with both operational downtime and the long-term consequences of data exposure.

For organizations operating in the technology and e-commerce sectors, maintaining robust security postures is critical to mitigating these risks. Defensive strategies often include implementing multi-factor authentication, maintaining regular offline backups, and conducting thorough employee training to recognize phishing attempts. Furthermore, ensuring compliance with regional data protection regulations, such as GDPR, is essential for managing the legal and administrative risks associated with potential data breaches. Because these attacks can impact supply chain partners, a comprehensive incident response plan is a vital component of organizational resilience.