Level listed on Medusa ransomware leak site following alleged data breach

• Ransomware group: Medusa
• Country: United States
• Sector: Financial Services
• Announcement date: September 3, 2025

Medusa ransomware group claims attack on fintech firm Level

The Medusa ransomware group has officially listed the fintech company Level on its dedicated leak site. According to the announcement made on September 3, 2025, the threat actors claim to have successfully breached the organization's systems. This listing follows an alleged attack date of September 1, 2025, marking a significant escalation in the ongoing threat landscape facing financial technology providers.

The threat actors have moved beyond simple encryption, employing a double extortion tactic. In this method, attackers not only lock a company's digital assets but also threaten to release sensitive information on public leak sites to pressure the victim into paying. In this specific instance, the Medusa group has demanded a ransom of 200,000 dollars from Level to prevent the further dissemination of the stolen information.

Details of the alleged data exposure

As part of their public announcement, the Medusa group has released several file samples that they claim belong to the operational processes of Level. These samples serve as a method of verification to prove the validity of their claims to the victim and the public. The shared content includes screenshots of various documents and databases that allegedly contain sensitive corporate and personal information.

The leaked content appears to focus heavily on insurance and health-related documentation. Specifically, the screenshots display tables containing information regarding various insurance plans and medical service providers, including Blue Cross, UnitedHealth, Cigna, and Kaiser. Furthermore, the data reportedly includes specific details regarding family health policies. The types of data allegedly involved in this breach include:

• Health insurance data
• Policy information
• Employee benefits data

About Level

Level is a B2B2C fintech company that specializes in the development of payment technologies. Their primary mission is to assist employers in offering more accessible and personalized benefits to their teams. The organization was established by a group of professionals with backgrounds from several industry-leading firms, including Square, Google, and Uber.

Risk assessment and implications for the sector

The alleged breach of Level presents a high level of risk due to the sensitive nature of the data involved. Because the information pertains to employee benefits and health insurance, it contains highly personal details that are a primary target for malicious actors. The exposure of such data can create a foundation for identity theft and highly targeted phishing attacks directed at the affected employees.

Given that Level is based in the United States, this incident could potentially lead to significant legal sanctions. The nature of the data suggests possible implications under the Health Insurance Portability and Accountability Act (HIPAA) as well as various relevant state-level data protection laws. The organization may face intense pressure to meet ransom demands to recover their data or to prevent the continuous leaking of information.

Furthermore, the impact of such an incident is rarely contained within a single organization. In a B2B2C model, secondary risks may emerge for the organization's supply chain partners and its various clients. For organizations operating within the financial services and fintech sectors, this incident highlights the critical importance of robust defensive measures. Common industry practices to mitigate such risks include implementing multi-factor authentication, maintaining strict network segmentation, and conducting regular security audits to identify vulnerabilities before they can be exploited by ransomware groups.