Medusa ransomware group claims attack on Cemtrex

• Ransomware group: Medusa
• Country: United States
• Sector: Manufacturing
• Announcement date: October 14, 2025

Medusa ransomware group targets Cemtrex

The Medusa ransomware group has published data on its leak site, claiming it belongs to the US-based manufacturing company Cemtrex. The announcement, made on October 14, 2025, follows a claimed attack date of October 13, 2025. This development highlights the ongoing pressure exerted by ransomware groups through public data exposure.

Details of the claimed attack

According to the claims made by the Medusa group, they conducted a ransomware attack against Cemtrex. The group has listed the company on its dedicated leak site as part of its extortion process. As part of this announcement, the group has shared sample files that are alleged to contain the company's operational and personal data.

The group is currently demanding a ransom of 150,000 USD. Medusa is a group known to have been active since 2021. They are recognized for utilizing their leak site to exert pressure on victims, a tactic designed to force compliance through the threat of public data exposure. If the ransom is not paid, the likelihood of a full data dump may increase.

Data involved in the leak

The group has provided screenshots as evidence of the breach. These screenshots display various types of sensitive information, including health insurance claim forms, personal identification information, and various corporate documents. The specific types of data identified in the listing include:

• Health insurance records
• Personal identification information
• Corporate documents

While the group has provided these samples, the total size of the stolen data and the exact file count have not been disclosed by the attackers.

About Cemtrex

Cemtrex is a diversified industrial technology company based in New York. The organization provides a variety of specialized services, including manufacturing services for custom-engineered electronics, industrial contracting services, and monitoring instruments for environmental compliance.

Risk assessment and industry implications

Given the Medusa group's known double-extortion tactics, the public release of this data may pose a risk of identity theft for the company's employees and customers. In a double-extortion scenario, attackers not only encrypt an organization's data but also steal it, threatening to leak it publicly to increase the pressure to pay the ransom.

As a US-based entity, the incident may result in implications regarding state-level data protection laws and potential regulatory compliance processes. Furthermore, because the company operates in the manufacturing sector, the exposure of data could lead to secondary risks through the exposure of intellectual property or trade secrets.

Organizations operating in the manufacturing sector often face significant risks when intellectual property is targeted. To mitigate such risks, companies typically focus on robust access controls, network segmentation, and continuous monitoring of their digital environments. Implementing comprehensive data encryption and regular offline backups are also standard defensive measures used to protect against the impact of ransomware and unauthorized data exfiltration.