Loreto Normanhurst listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Australia
• Sector: Education
• Announcement date: May 22, 2023

The Medusa ransomware group has listed the Australian educational institution Loreto Normanhurst on its dedicated leak site. According to the announcement made on May 22, 2023, the threat actors claim to have successfully compromised the organization's data and are currently demanding a ransom payment to prevent further action.

The details of the claim

The listing appeared on the Medusa leak site on May 22, 2023, coinciding with the date the group claims the attack occurred. The threat actors have asserted that they have gained unauthorized access to the institution's internal data. In their announcement, the group has set a ransom demand of 200,000 USD.

The leak site listing includes a countdown timer, a common tactic used by ransomware groups to pressure victims into paying. Furthermore, the group provides options for the victim, which include either the deletion of the alleged stolen data or the downloading of the files. This approach is characteristic of modern ransomware operations that utilize public pressure to facilitate extortion.

Data and information involved

While the exact volume and count of the files have not been specified, the threat actors have provided screenshots as evidence of the breach. These samples indicate that the compromised information includes various internal documents. Specifically, the screenshots display details related to staff position descriptions, job responsibilities, and educational qualifications. Additionally, the leaked samples include financial statement data.

Based on the provided information, the sensitive data categories affected include:

• Staff personal information
• Financial data

About Loreto Normanhurst

Loreto Normanhurst is an independent Catholic day and boarding school for girls located in Sydney, Australia. The institution serves students from Year 5 to Year 12. Established in 1897, it holds the distinction of being the largest girls' boarding school in New South Wales.

Analysis and potential risks

The Medusa group is recognized as a Ransomware-as-a-Service (RaaS) operation. Such groups are known for employing double extortion tactics, where they not only encrypt an organization's systems but also steal sensitive data to threaten its public release. This dual-threat approach significantly increases the pressure on the victim to comply with ransom demands.

Because Loreto Normanhurst operates within the education sector, there is a significant risk regarding the potential exposure of sensitive data belonging to both students and staff. Such a breach could trigger legal processes under Australian privacy regulations. The potential publication of this data may lead to secondary risks for the individuals involved, including the possibility of identity theft or the execution of targeted phishing attacks against staff and students.

If the institution does not meet the ransom demand, the threat actors have indicated that the data may be released publicly. In general, organizations facing such threats are encouraged to implement robust defensive measures, such as maintaining offline backups, enforcing multi-factor authentication, and conducting regular security awareness training to mitigate the risk of initial access and subsequent data exfiltration.