Medusa ransomware group targets SRP Companies with second attack claim

• Ransomware group: Medusa
• Country: United States
• Sector: Professional Services
• Announcement date: March 16, 2025

Medusa claims a second breach of SRP Companies

The Medusa ransomware group has announced that it has successfully targeted SRP Companies, a North American provider of consumer products and retail solutions. According to the threat actor, this incident marks a second successful intrusion into the organization's systems. The group claims that the target has failed to comply with a previous ransom agreement and has neglected to address existing security vulnerabilities that allowed for this renewed access.

In their announcement, the Medusa group alleges that they have encrypted the organization's data. As a result of this alleged encryption and the failure to meet prior demands, the threat actor is now demanding a ransom payment of 1,000,000 USD. This development highlights the persistent nature of certain ransomware groups that return to a victim if they perceive the initial defenses or negotiations were insufficient.

Details regarding the alleged data exfiltration

While the threat actor has claimed to have gained access to the systems and encrypted data, specific information regarding the type and scope of the allegedly exfiltrated data has not been provided. The announcement provided by the group includes a screenshot that contains a redirect to a verification page rather than a detailed inventory of stolen files.

• No specific data types were named in the listing.

In many ransomware scenarios, groups utilize double-extortion tactics. This method involves not only encrypting the victim's files to disrupt operations but also stealing sensitive information beforehand. The threat of leaking this data on a public leak site serves as additional leverage to compel the victim to pay the ransom. When a group claims a second breach, it often suggests that the initial remediation efforts were unsuccessful or that the threat actor maintained a persistent presence within the network.

About SRP Companies

SRP Companies is a North American provider of consumer products and single-source retail solutions for retail outlets. The company offers a wide range of services, including direct-store-delivery, supply chain optimization, and data analytics. Their services are utilized by various channels, such as convenience stores, travel stops, theme parks, and sporting goods retailers.

Potential impact and industry implications

The claims made by the Medusa group suggest that the organization faces a significant risk of sensitive data publication. Because SRP Companies is a US-based entity, any confirmed data breaches may lead to legal consequences under state-level data protection laws and regulations. The nature of their business means that their supply chain and logistics operations could be disrupted by such an attack, which potentially creates secondary risks for their various business partners.

Furthermore, the exposure of employee and customer data may facilitate identity theft and targeted phishing attacks. For organizations operating in the professional services and logistics sectors, these types of attacks emphasize the importance of robust security postures. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent vulnerability assessments to close the gaps that threat actors exploit.

The situation involving SRP Companies underscores the complexities of managing supply chain security. When a provider of retail solutions is compromised, the ripple effects can extend to numerous downstream partners. Organizations in this sector must prioritize visibility into their digital supply chain to mitigate the risks posed by third-party breaches and the evolving tactics of ransomware groups like Medusa.