Medusa ransomware group claims data breach against Leprohon

• Ransomware group: Medusa
• Country: Canada
• Sector: Technology
• Announcement date: October 4, 2025

Medusa ransomware group claims data breach against Leprohon

The Medusa ransomware group has claimed responsibility for a cyberattack targeting Leprohon, a company based in Canada. According to an announcement made on the group's leak site, the threat actors have allegedly published sensitive data belonging to the organization as part of their extortion attempt.

Details of the alleged attack

The Medusa group announced that it targeted Leprohon in a post published on October 9, 2025. Through this announcement, the group states that it is demanding a ransom of 800,000 dollars from the organization to prevent further exposure of the stolen information. The claim suggests that the breach occurred shortly before the public announcement, with the group alleging the attack took place on October 3, 2025.

In their public post, the threat actors provided specific details regarding the victim organization's operations and scale. The group claims that Leprohon operates within the commercial and residential construction sector and maintains a workforce of approximately 351 people. This type of public naming is a common tactic used by ransomware groups to exert maximum pressure on a victim to meet their financial demands.

Data types involved in the leak

The threat actors provided screenshots as evidence of the breach in their leak announcement. These images purportedly display various types of sensitive documentation that have been exfiltrated from the organization's systems. Based on the samples provided by the group, the following types of data are reportedly included in the leak:

• Payroll records
• Financial statements
• Technical reports

The inclusion of such diverse documentation suggests a broad access to the company's internal administrative and operational files.

About Leprohon

Leprohon Inc. is a construction company based in Quebec, Canada, operating in the commercial and residential construction sector. Headquartered in Sherbrooke, the company provides services for infrastructure and building projects.

Analysis and implications of the incident

This incident indicates that the Medusa group is utilizing a double-extortion strategy to increase pressure on the organization. Double extortion is a common ransomware tactic where attackers not only encrypt a victim's data to disrupt operations but also steal sensitive information beforehand. The attackers then threaten to leak this data on public forums if the ransom is not paid, thereby creating a secondary layer of leverage.

The alleged exposure of employee payroll information may lead to identity theft and fraud risks for the staff members involved. Furthermore, given that the company operates in Canada, the incident may result in legal implications under data protection regulations such as the Personal Information Protection and Electronic Documents Act (PIPEDA). Beyond the legal and regulatory risks, it is assessed that the organization could face significant operational disruptions and potential damage to its commercial reputation.

For organizations operating in the construction and infrastructure sectors, such incidents highlight the critical importance of robust data protection frameworks. To mitigate the risks associated with ransomware and data exfiltration, companies often implement defensive measures such as multi-factor authentication, regular offline backups, and comprehensive employee training to recognize phishing attempts. Maintaining strict access controls and monitoring network traffic for unusual activity are also essential components of a modern cybersecurity posture designed to defend against sophisticated extortion groups.