Medusa ransomware group targets Pozzi Italy with data breach claim

• Ransomware group: Medusa
• Country: Italy
• Sector: Manufacturing
• Announcement date: January 22, 2024

Medusa ransomware group claims data breach at Pozzi Italy

The Medusa ransomware group has officially listed the Italy-based organization Pozzi Italy on its dedicated leak site. According to the announcement made on January 22, 2024, the threat actor group alleges that they have successfully compromised the company's data and are now engaging in extortion tactics.

The group claims to have targeted the organization on January 22, 2024, the same day the announcement was posted. As part of their extortion attempt, the Medusa group has stated that they are demanding a ransom payment of $100,000 from the organization. The nature of the announcement indicates that the attackers are requiring this payment in exchange for either the deletion of the stolen data or a guarantee that the data will not be published online.

Details of the alleged data theft

While the specific volume of data and the exact number of files stolen have not been disclosed by the group, the screenshots provided by the attackers offer a glimpse into the nature of the breach. The leaked material reportedly includes various files that appear to be linked to the internal operations of the company. Specifically, the evidence provided by the group includes:

• Financial data
• Operational documents

The presence of these documents, which include spreadsheets containing financial information and photos related to operational processes, suggests that the breach may impact the company's internal administrative and manufacturing workflows.

About Pozzi Italy

Pozzi Italy, operating under the name Pozzi Leopoldo Srl, is a company based in Italy that functions within the machinery industry. The company is headquartered in Barlassina, located in the Lombardy region. Pozzi Leopoldo Srl provides specialized services and products in the field of industrial machinery manufacturing.

Analysis and potential impact of the attack

The Medusa group, which has been active since 2021, typically follows a pattern of leaking exfiltrated data if the ransom demands are not met. Because this group employs a double-extortion strategy—whereby they both encrypt systems and threaten to leak sensitive information—the potential consequences for the victim are multifaceted. If the claimed data is published, the organization could face significant reputational damage and substantial operational disruptions.

Furthermore, because the company is based in Italy, this breach may trigger legal consequences under the EU General Data Protection Regulation (GDPR) regarding the handling of sensitive information. The exposure of commercial and employee data also introduces secondary risks, such as the possibility of phishing attacks targeting the company's various supply chain partners.

The fact that the target is a small-scale business may suggest that its cybersecurity measures could be limited, which can lead to a more significant impact from such an attack. In the manufacturing sector, maintaining robust cybersecurity is vital to protect proprietary operational processes and financial integrity. Organizations in this sector often focus on securing their industrial control systems, implementing strict access controls, and conducting regular backups to mitigate the impact of such extortion-based threats.