Friendship House listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: United States
• Sector: Healthcare
• Announcement date: February 25, 2025

The Medusa ransomware group has listed the United States-based healthcare provider Friendship House on its dedicated leak site. According to an announcement published by the threat actor on February 25, 2025, the group claims to have compromised data belonging to the organization.

Details of the alleged attack

The threat actor known as Medusa has officially added Friendship House to its target list via a public notification. This announcement was made through the group's dedicated leak portal on February 25, 2025, which is the same date the group claims the attack occurred. This type of public listing is a common tactic used by ransomware groups to pressure victims into meeting their demands.

Ransomware leak sites serve as a platform for cybercriminals to host information stolen during a breach. These sites are often used to shame organizations and demonstrate the group's ability to exfiltrate sensitive information. By publishing an organization's name, the threat actors aim to increase the visibility of the incident and create reputational pressure on the victim.

Data and information involved

Regarding the nature of the allegedly compromised information, no details have been provided by the threat actor. The listing does not specify the volume of data or the specific types of files that were targeted. The current information available from the group's portal consists of a verification page, which serves as proof of the compromise without disclosing the actual contents of the stolen data.

Affected data types

• The listing names no specific data types.

About Friendship House

Friendship House is a healthcare organization located in Grand Island, Nebraska. The institution provides specialized clinical services in the field of mental health and substance abuse. Their medical services include both inpatient and outpatient treatments designed to support individuals undergoing recovery and mental health management.

Implications and industry risks

The Medusa group is recognized as a Ransomware-as-a-Service (RaaS) operation that has been active since 2021. This group is known for employing double extortion tactics, a method where attackers not only encrypt an organization's data but also steal sensitive information to threaten its public release. This dual-threat approach significantly increases the pressure on victims to comply with ransom demands.

Because Friendship House operates within the healthcare sector, any potential data breach carries significant risks. Such incidents can pose serious threats to patient privacy and may lead to complications regarding compliance with HIPAA regulations. Furthermore, the alleged incident could lead to secondary risks for both employees and patients, such as the potential for identity theft or the execution of targeted phishing attacks.

Given the established modus operandi of the Medusa group, there is a possibility that the data may be published or sold on the dark web if the ransom demands are not met. In the healthcare industry, organizations typically focus on robust defensive measures to mitigate these risks, such as implementing strict access controls, maintaining comprehensive backups, and conducting regular security awareness training to prevent unauthorized access to sensitive medical records.