Medusa ransomware group lists Leprohon (Image !) on its leak site

• Ransomware group: Medusa
• Country: Canada
• Announcement date: October 14, 2025

Medusa ransomware group claims attack on Leprohon

The Medusa ransomware group has listed data it claims belongs to Leprohon, a construction company based in Canada, on its dedicated leak site. According to the announcement made on October 14, 2025, the group is demanding a ransom payment of 800,000 USD. The threat actors claim that the initial attack took place on October 9, 2025.

Ransomware attacks of this nature typically involve a multi-stage process where attackers gain unauthorized access to a network, escalate privileges, and eventually exfiltrate sensitive information before deploying encryption software. The Medusa group is recognized as a Ransomware-as-a-Service (RaaS) entity that has been active since 2021. This group is known for employing double-extortion tactics, a method where attackers not only encrypt the victim's data to disrupt operations but also threaten to leak the stolen information on public forums if the ransom is not met. This dual pressure aims to maximize the likelihood of payment by threatening the victim's reputation and legal standing.

Details of the claimed data breach

The listing provided by the Medusa group includes screenshots as evidence of the theft. These visual samples suggest that the stolen information is significant and covers various administrative and operational aspects of the company. The group has not provided specific details regarding the total volume of data stolen or the exact number of files involved in the breach.

Based on the information provided in the leak site announcement, the following types of data are reportedly included in the breach:

• Payroll records
• Financial documents
• Technical reports

The presence of such diverse data types suggests a broad compromise of the organization's internal systems, ranging from human resources and accounting to technical operations.

About Leprohon

Leprohon Inc. is a construction company based in Quebec, Canada. The organization operates within the commercial and residential construction industry. The company maintains a workforce of approximately 351 employees to carry out its various projects.

Impact and industry implications

The leakage of data belonging to Leprohon carries several significant risks. For the employees of the company, the exposure of payroll records and other personal information can lead to identity theft and other forms of fraud. For the organization itself, the publication of technical reports that may contain trade secrets could negatively impact its competitive position in the construction market. Furthermore, such breaches can serve as a foundation for subsequent supply chain attacks, as partners and clients may be targeted through the leaked information.

From a regulatory perspective, as a company operating in Canada, Leprohon may face data breach notification obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA) regulations. Such frameworks are designed to ensure that individuals are informed when their personal data has been compromised, allowing them to take protective measures.

In general, organizations operating in the construction and commercial sectors can take several defensive steps to mitigate the risks of ransomware and data exfiltration. Implementing robust multi-factor authentication (MFA) across all remote access points is a fundamental security control. Regular, offline backups of critical data and technical documentation are essential for recovery. Additionally, organizations should focus on network segmentation to prevent attackers from moving laterally from administrative systems to sensitive technical or financial repositories. Continuous monitoring of network traffic and employee security awareness training are also vital components of a comprehensive defense strategy against modern ransomware groups.