LaRosa’s Pizzeria targeted by Medusa ransomware group

• Ransomware group: Medusa
• Country: United States
• Sector: Hospitality
• Announcement date: November 7, 2025

Medusa ransomware group claims attack on LaRosa’s Pizzeria

The threat actor known as Medusa has listed data allegedly belonging to LaRosa’s Pizzeria on its leak site. According to the group's announcement, the incident occurred on November 5, 2025. The group is currently demanding a ransom of $100,000 to prevent the publication of the stolen information.

Ransomware attacks of this nature typically involve a process where attackers gain unauthorized access to a network and encrypt critical files. In many modern cases, threat actors employ a strategy known as double extortion. This method involves not only encrypting the victim's data to disrupt operations but also exfiltrating sensitive information to use as leverage. If the victim refuses to pay the ransom, the attackers threaten to leak the stolen data on public forums or dedicated leak sites, causing significant reputational and legal damage.

Details of the claimed data breach

The announcement made by the Medusa group includes various document samples that are purported to contain sensitive internal information. Based on the screenshots provided by the attackers, the leaked content is said to include the company's financial statements and operational data. Specifically, the samples displayed in the leak listing appear to contain the following types of information:

• Financial statements
• Sales reports
• Operational data

The presence of such documents in a leak listing suggests that the attackers may have gained access to core business functions. When sensitive documents like sales reports and financial statements are compromised, it can expose the inner workings of a company's commercial activities to the public or to competitors.

About LaRosa’s Pizzeria

LaRosa's Pizzeria is a family-owned restaurant chain founded in 1954 by Donald LaRosa. The company operates across Ohio, Kentucky, and Indiana. Known for its Italian-inspired dishes and signature thin-crust pizzas, the company is a well-established business headquartered in Cincinnati, Ohio.

Potential impact and industry implications

The potential exposure of this data could lead to significant consequences for the organization. The leak of financial data and operational information may increase the risk of identity theft or targeted phishing attacks against customers and employees. Furthermore, because the company is based in the United States, this incident may trigger legal processes under state-level data protection laws and relevant regulations.

For organizations in the hospitality sector, maintaining the confidentiality of operational and financial data is critical for maintaining commercial reputation and ensuring operational continuity. If the data is fully released, the group's double-extortion strategy could result in significant damage to the company's standing. To defend against such threats, organizations generally focus on robust security measures, such as implementing multi-factor authentication, maintaining regular offline backups, and conducting regular employee training to recognize phishing attempts.

The Medusa group, which has been active since 2021, continues to utilize these high-pressure tactics to extract payments from victims. As seen in this case, the threat of leaking sensitive business intelligence remains a primary driver for ransom demands in the current cyber threat landscape.