JBS listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: United States
• Sector: Healthcare
• Announcement date: December 28, 2025

The Medusa ransomware group has listed the Alabama-based healthcare organization JBS on its dedicated leak site. According to the announcement made by the threat actors, the organization has been targeted in a cyberattack resulting in a significant data breach.

Details of the claimed attack

The Medusa ransomware group claims to have exfiltrated 168.6 GB of data belonging to JBS. This announcement was published on the group's leak site on December 28, 2025, though the group states the initial attack occurred on December 23, 2025. As part of their established double extortion strategy, the group is demanding a ransom of 200,000 dollars from the organization to prevent the release of the stolen information.

Double extortion is a common tactic used by modern ransomware groups. In this approach, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data before the encryption phase. This allows the attackers to threaten the victim with the public disclosure of their private information, creating additional leverage to compel payment. By using a leak site, the group exerts psychological and reputational pressure on the target, making the threat of data exposure a central component of their extortion attempt.

Data involved in the breach

The threat actors have provided evidence of the stolen information by sharing screenshots on their leak site. These samples suggest that the breach involves various internal documents that could be highly sensitive to the organization's operations. The data claimed to be stolen includes:

• Financial data
• Administrative documents
• Operational reports

The presence of these document types indicates that the attackers have gained access to the core administrative and fiscal functions of the organization. When such data is leaked, it can lead to significant operational challenges and long-term complications for the entity involved.

About JBS

JBS is a regional, nonprofit public authority that plays a critical role in the mental health infrastructure of Alabama. The organization is responsible for planning, coordinating, and developing mental health services specifically for Jefferson, Blount, and St. Clair counties. Furthermore, JBS manages the essential tasks of funding, budgeting, and the overall delivery of mental health programs across the specified region.

Analysis and implications for the healthcare sector

The involvement of the Medusa group, which has been active since 2021, highlights the ongoing risk posed by sophisticated ransomware actors. Because the Medusa group is known for using its leak site to exert pressure on victims, the risk of public disclosure for JBS remains high. The nature of the stolen data suggests that the organization's sensitive information is at significant risk.

For entities operating within the healthcare sector, such breaches carry specific regulatory and security implications. Because the leaked information may involve sensitive data, it may fall under strict regulatory frameworks such as HIPAA. This could potentially lead to legal consequences for the organization. Additionally, the stolen administrative and operational documents could be exploited by malicious actors for identity theft or for conducting highly targeted phishing attacks against the organization or its stakeholders.

To mitigate such risks, organizations in the healthcare sector often need to review their security protocols and implement robust defensive measures. Common defensive steps include maintaining offline backups, implementing multi-factor authentication, and ensuring continuous monitoring of network traffic to detect unauthorized data exfiltration. Furthermore, when a breach is suspected, organizations may need to notify affected parties to comply with legal requirements and to help individuals protect themselves from potential identity theft or phishing attempts.