Juntadeandalucia listed on Medusalocker leak site

• Ransomware group: Medusalocker
• Country: Spain
• Sector: Government & Defense
• Announcement date: September 28, 2026

Medusalocker claims data leak involving Juntadeandalucia

The threat actor known as Medusalocker has listed the Spanish regional government organization, Juntadeandalucia, on its dedicated leak site. According to the announcement made on September 28, 2026, the group claims to have successfully extracted sensitive information from the organization's systems during a recent attack.

This type of activity is characteristic of modern ransomware operations. Many contemporary cybercriminal groups utilize a strategy known as double extortion. In these scenarios, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The threat actors then use the threat of leaking this stolen data on public platforms to pressure the victim into paying a ransom. By publishing names of organizations on leak sites, these groups aim to maximize visibility and reputational damage to increase their leverage.

Details of the alleged breach

The Medusalocker group alleges that the breach resulted in the theft of specific contact information. While the group's announcement was made on September 28, 2026, the provided evidence remains limited. The visual evidence associated with the listing consists of a browser verification page, which means that no detailed visual evidence or direct screenshots of the actual leaked data were available to confirm the contents of the breach.

The group claims that the following data types were involved in the incident:

• Email addresses

Despite the claim of a data leak, the available documentation does not provide specific details regarding the total size of the data stolen or the exact file count. Furthermore, no information was provided regarding a ransom demand or the specific motivations behind this particular attack on the regional government.

About Juntadeandalucia

Juntadeandalucia, officially known as the Regional Government of Andalusia, serves as the primary governing body for the Andalusia region located in southern Spain. As a major administrative entity, the organization is responsible for the management of a wide array of public services. This includes the oversight of education, healthcare, and various other administrative affairs required to run the region at a regional level.

Risk assessment and security implications

The potential exposure of email addresses poses significant secondary risks to the organization. When email addresses are leaked, they can be used as a primary vector for subsequent cyberattacks, most notably phishing campaigns. In such attacks, malicious actors use the stolen addresses to send deceptive communications designed to trick employees or associated individuals into revealing credentials or installing malware.

Because Juntadeandalucia operates within Spain, this incident may fall under the regulatory scope of the EU General Data Protection Regulation (GDPR), which governs how personal data must be protected and how breaches must be reported. While public information regarding the specific methods and motivations of the Medusalocker group remains limited, the incident highlights the ongoing threat to government entities.

For organizations operating in the government and public service sectors, maintaining robust data security processes is essential. This includes implementing multi-factor authentication, conducting regular security awareness training to defend against phishing, and maintaining rigorous monitoring of network traffic to detect unauthorized data exfiltration. It is often advisable for organizations to review their security measures and implement necessary protections for all affected accounts to mitigate the risk of follow-on attacks.