J McCann & Co Ltd listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: United Kingdom
• Sector: Manufacturing
• Announcement date: March 20, 2025

The Medusa ransomware group has officially listed the United Kingdom-based organization J McCann & Co Ltd on its dedicated leak site. According to the announcement made by the threat actors, the group claims to be in possession of a significant volume of the company's data, marking a new targeted incident involving the construction and infrastructure sector.

Details of the claimed attack

According to the information published on the Medusa leak site, the incident involving J McCann & Co Ltd was announced on March 20, 2025. The threat actors claim that the actual attack or data breach occurred the previous day, on March 19, 2025. This timeline suggests a rapid transition from the initial compromise to the public extortion phase.

In connection with this alleged breach, the Medusa group has issued a ransom demand. The threat actors are reportedly demanding a payment of 150,000 USD to prevent the further release of the information they claim to have exfiltrated. Such demands are a hallmark of modern ransomware operations, where attackers leverage the threat of data exposure to pressure victims into paying significant sums of money.

Data involvement and volume

The Medusa group has made specific claims regarding the scale of the data they have allegedly stolen from J McCann & Co Ltd. The group asserts that they have acquired approximately 146.60 GB of data belonging to the organization. While the volume of the data is specified, the group has not provided any specific details regarding the nature or the specific types of the leaked data. The only evidence provided by the attackers in their announcement was a screenshot displaying a verification page, rather than a detailed inventory of the files stolen.

Summary of claimed data details

• Total claimed data size: 146.60 GB
• Specific data types: No specific details provided

About J McCann & Co Ltd

J McCann & Co Ltd is a prominent construction company headquartered in Nottingham, United Kingdom. The firm maintains a diverse portfolio, operating extensively in both commercial and residential construction sectors. Furthermore, the company is heavily involved in large-scale infrastructure projects. Their specialized areas of expertise include critical services such as street lighting, traffic signaling, and the development of electrical infrastructure, making them a key player in the UK's physical and utility networks.

Analysis and industry implications

The Medusa group is recognized as a Ransomware-as-a-Service (RaaS) operation that has been active since 2021. This operational model suggests that the attack against J McCann & Co Ltd may have been carried out with professional motivation, utilizing specialized tools and techniques developed by the RaaS provider. Because the Medusa group typically employs a double-extortion strategy, there is a heightened risk that the allegedly stolen data could be published on the dark web or sold to unauthorized third parties if the ransom is not met.

For a company operating within the United Kingdom, such a breach carries significant legal and regulatory implications. A confirmed breach involving personal information could trigger mandatory legal obligations and administrative penalties under the UK GDPR. Furthermore, the exposure of sensitive employee or customer information creates dangerous opportunities for secondary crimes, such as identity theft or highly targeted phishing attacks against the organization's stakeholders.

In the construction and infrastructure sector, maintaining data integrity and confidentiality is vital for project safety and regulatory compliance. Organizations in this sector often face risks related to supply chain vulnerabilities and the protection of sensitive architectural or electrical blueprints. To mitigate such risks, companies generally focus on robust backup strategies, continuous monitoring of network traffic, and strict access controls to prevent unauthorized lateral movement by threat actors.