Medusa ransomware group claims data breach against LGB

• Ransomware group: Medusa
• Country: United Kingdom
• Sector: Manufacturing
• Announcement date: October 4, 2025

Medusa ransomware group claims data breach against LGB

The Medusa ransomware group has officially listed the automotive component manufacturer LGB on its dedicated leak site. According to the announcement made on October 4, 2025, the threat actors claim to have successfully exfiltrated data from the organization. This latest development follows a claimed attack date of October 3, 2025, signaling a rapid escalation from the initial intrusion to the public extortion phase.

Details of the Medusa extortion claim

The threat actor known as Medusa is utilizing its leak site to pressure the organization through public exposure. The group has demanded a ransom of 600,000 USD in exchange for the data they claim to have stolen. To substantiate their claims, the group has provided samples of documents that appear to be directly related to the internal operational processes of the company.

The evidence provided by the attackers includes various screenshots of internal files. These visual samples reveal the presence of sensitive information, such as cost calculation spreadsheets and technical documents that are integral to the company's production processes. Furthermore, the leaked directory structure includes a specific folder named 'brolon', which suggests the breach may have reached deep into the company's file management systems.

Affected data types

• Production process data
• Cost spreadsheets
• Technical documents

About LGB

LGB (L.G. Balakrishnan & Bros Ltd) is an India-based automotive component manufacturer known for its 'ROLON' brand. The company specializes in the production of automotive chains, sprockets, and tensioners. Founded in 1937, the organization has established itself as a leading OEM supplier for both two-wheeler and four-wheeler vehicles, playing a significant role in the automotive supply chain.

Impact and security implications

The Medusa group is known for operating under a double-extortion model. In this model, attackers do not merely encrypt a company's systems but also steal sensitive data, threatening to release it publicly to maximize leverage. The public release of the alleged data could lead to significant reputational damage and the exposure of critical trade secrets for the organization. Such an exposure poses a direct threat to the company's competitive advantage and its standing in the global market.

The potential fallout extends beyond the organization itself. The company's production operations and its various supply chain partners may be adversely affected by the fallout of such a data breach. Furthermore, if the stolen data includes the personal information of employees, the organization may face legal sanctions under data protection regulations, such as the General Data Protection Regulation (GDPR).

Looking at the broader threat landscape, the group's past activities suggest that these types of attacks can serve as a precursor to further malicious activity. For instance, the information exfiltrated during a breach can be used to facilitate targeted phishing campaigns or to launch secondary attacks against the organization or its partners. Organizations in the manufacturing sector should remain vigilant, as the exposure of technical documents and production processes can provide attackers with the necessary intelligence to craft more sophisticated social engineering attacks.