Medusa ransomware group targets Coldwell Banker D’Ann Harper, REALTORS

• Ransomware group: Medusa
• Country: United States
• Sector: Professional Services
• Announcement date: March 16, 2025

Medusa claims data theft from Coldwell Banker D’Ann Harper, REALTORS

The threat actor known as Medusa has announced the listing of Coldwell Banker D’Ann Harper, REALTORS on its dedicated leak site. According to the group's announcement, the organization has been targeted in a cyberattack, and the group claims to have exfiltrated a significant amount of data belonging to the firm.

The claim was made on March 16, 2025, with the group alleging that the attack itself also took place on the same date. This sudden announcement follows a pattern of behavior observed in modern ransomware operations, where groups use public platforms to pressure victims into meeting their demands.

Details of the claim and ransom demand

The Medusa ransomware group has stated that it is demanding a ransom payment of 150,000 USD from the organization. This demand is part of the group's extortion strategy, which typically involves threatening the release of sensitive information if the payment is not met.

While the group has listed the organization on its leak site, no detailed list regarding the specific content of the leaked data has been provided. Furthermore, the group's provided screenshots do not offer any information on the specific content of the files because they lead to a verification page. Consequently, the exact nature of the files involved remains unconfirmed by the available evidence.

Data volume and potential impact

Regarding the scale of the alleged breach, the group claims that the total volume of the compromised data amounts to 133.30 GB. The listing does not provide a specific file count for the stolen data.

• The listing names no specific data types.

Given the double-extortion tactics employed by the Medusa group, there is a significant risk that the allegedly exfiltrated data could be published publicly or sold to third parties. Medusa is recognized as a Ransomware-as-a-Service (RaaS) entity that has been tracked since 2021 and launched its own leak site in 2023. The use of double extortion—where attackers both encrypt data and threaten to leak it—increases the pressure on organizations to comply with ransom demands.

Organizational profile

Coldwell Banker D’Ann Harper, REALTORS is a residential real estate brokerage firm operating in the Central and South Texas region. As part of the Coldwell Banker network, it provides services through multiple offices and a large team of sales agents.

Risk assessment and industry implications

The potential consequences for an organization in the professional services sector following such an event are multifaceted. Beyond the immediate operational disruptions that a ransomware attack can cause, the institution may face significant reputational damage. Because the group operates in the United States, the incident may trigger legal processes under state-level data protection laws and various sectoral regulations.

Secondary risks that often follow such breaches include the threat of identity theft or highly targeted phishing attacks directed at the organization's employees and customers. When sensitive information is exfiltrated, attackers often use it to craft more convincing social engineering campaigns to further compromise the network or defraud individuals.

For organizations operating in the real estate and professional services sectors, maintaining robust cybersecurity posture is critical. This includes implementing strict access controls, regular data backups, and continuous monitoring of network traffic to detect unauthorized exfiltration. As ransomware groups continue to evolve their tactics, such as the RaaS model used by Medusa, the necessity for comprehensive incident response plans becomes even more vital to mitigate both legal and reputational fallout.