Florarte listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Brazil
• Sector: Retail & E-Commerce
• Announcement date: August 20, 2025

The Medusa ransomware group has listed the Brazilian company Florarte on its dedicated leak site. According to the claims made by the threat actors, the organization has been targeted in a cyberattack resulting in a significant data breach.

The claimed attack and ransom demand

The Medusa ransomware group alleges that they successfully carried out an attack against Florarte on August 17, 2025. Following this intrusion, the group claims to have exfiltrated 184.8 GB of data from the organization's systems. This information was officially announced on the group's leak site on August 20, 2025.

In line with modern ransomware tactics, the threat actors are employing a extortion strategy. The group is demanding a ransom payment of 200,000 USD in exchange for their agreement not to publish the stolen information publicly. This type of pressure is a hallmark of ransomware operations, where the threat of data exposure is used to coerce the victim into paying a financial sum.

Data involved in the leak

While the total volume of stolen data is claimed to be 184.8 GB, the specific contents have been illustrated through screenshots shared on the leak site. These visual samples suggest that the stolen information includes sensitive corporate and administrative files. The data identified in the listing includes:

• Financial records
• Accounting data
• Operational documents

The presence of such documents on a leak site indicates that the attackers have gained access to the internal administrative workings of the company, which can lead to various secondary risks for the organization and its partners.

About Florarte

Florarte is a Brazilian company that specializes in the import and distribution of artificial plants and decorative products. Operating since 1992, the company provides a wide range of products within the home decor, household items, and seasonal decorations sectors.

Analysis and potential implications

This incident highlights the ongoing threat posed by the Medusa ransomware group. Medusa is recognized as a Ransomware-as-a-Service (RaaS) group that has been active since 2021. The group is known for adopting a double extortion strategy, a method where attackers not only encrypt an organization's data but also steal it, threatening to leak it to increase the pressure on the victim to pay.

The leak of financial and operational documents can have negative impacts on Florarte's business operations and may damage customer trust. Furthermore, under the LGPD legislation currently in force in Brazil, the organization may face specific data breach notification obligations and could potentially face administrative sanctions. There is also a risk that the exfiltrated data could be used for identity theft or as a basis for secondary attacks. Additionally, the organization's supply chain partners and employees may face risks of targeted phishing attacks stemming from this breach.

In general, when organizations face such threats, defensive measures often include implementing robust data encryption, maintaining offline backups, and enforcing strict access controls. For companies in the retail and e-commerce sectors, protecting sensitive operational and financial data is critical to maintaining the integrity of the supply chain and ensuring compliance with regional data protection laws.