Medusa ransomware group claims data breach against Sampoerna Agro

• Ransomware group: Medusa
• Country: Indonesia
• Sector: Agriculture and Food Production
• Announcement date: December 19, 2025

Medusa ransomware group claims data breach against Sampoerna Agro

The Medusa ransomware group has published a listing on its leak site claiming to have acquired data belonging to Sampoerna Agro, an Indonesian-based company. According to the announcement made on December 19, 2025, the threat actors claim to have successfully compromised the organization during an incident that allegedly occurred on December 13, 2025.

Details of the alleged attack and ransom demand

The threat actor known as Medusa has listed Sampoerna Agro on its dedicated leak platform. In the announcement, the group claims to have gained access to the organization's environment following an incident stated to have occurred on December 13, 2025. The listing is associated with a specific financial demand, as the group has reportedly requested a ransom of 100,000 USD to prevent further exposure or to resolve the situation.

Ransomware groups like Medusa often utilize a method known as double extortion. In this scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. This allows the attackers to threaten the victim with the public release of their confidential information if the ransom is not paid. This tactic significantly increases the pressure on the victim, as the threat shifts from mere operational downtime to permanent reputational and legal damage.

Data types and evidence provided by the threat actor

The group has provided evidence to support their claims through the publication of screenshots. These images appear to display samples of various spreadsheets. Based on the provided materials, the information involved in the breach reportedly includes:

• Financial data
• Budget reports
• Operational data

The presence of such documents suggests that the attackers have gained access to internal administrative and management files. When sensitive spreadsheets containing financial statements and budget reports are leaked, it can expose the internal economic health and strategic planning of a company to competitors and the public.

About Sampoerna Agro

PT Sampoerna Agro Tbk is an Indonesia-based palm oil manufacturer. Founded in 1993, the company is a significant player in the agricultural sector. The organization engages in the production of various agricultural products, which include crude palm oil, palm kernel products, and germinated palm seeds.

Potential impact and industry implications

The claims made by the Medusa group may pose significant risks to Sampoerna Agro's operational continuity and commercial reputation. The publication of financial documents could lead to the exposure of sensitive information regarding internal operations, which is often critical for maintaining trust with stakeholders and business partners.

Furthermore, given the double-extortion tactics employed by the Medusa group—a Ransomware-as-a-Service (RaaS) structure that has been active since 2021—the release of such data may facilitate identity theft or targeted phishing attacks against employees and business partners. When operational and financial data is leaked, attackers can use the specific details found within those files to craft highly convincing social engineering campaigns.

Additionally, the organization may face legal obligations under Indonesian data protection regulations following such a breach. Organizations operating in the agriculture and food production sector often manage complex supply chains and vast amounts of operational data, making them targets for sophisticated threat actors. To mitigate such risks, organizations typically focus on robust backup strategies, continuous monitoring of their networks, and comprehensive employee training to defend against the phishing attempts that often follow a data leak.