Medusa ransomware group targets Windak in latest data breach claim

• Ransomware group: Medusa
• Country: United States
• Sector: Manufacturing
• Announcement date: October 2, 2023

Medusa ransomware group claims data breach at Windak

The Medusa ransomware group has officially listed the manufacturing company Windak on its dedicated leak site. According to the threat actors, they have successfully exfiltrated data belonging to the organization, marking the latest victim in the group's ongoing campaign of digital extortion.

This announcement, made on October 2, 2023, follows the group's established pattern of targeting various industries to exert pressure on their victims. By publishing the name of the organization on a public platform, the group aims to maximize visibility and pressure the target into meeting their demands.

Details of the extortion attempt

The threat actors behind the Medusa group have issued a ransom demand of 100,000 USD. This demand is presented as the price for ensuring that the data allegedly obtained from Windak is not published on the group's leak platform. The group is utilizing a double-extortion tactic, a common and highly effective method in modern ransomware operations. In this scenario, attackers do not merely encrypt a company's systems to disrupt operations; they also steal sensitive information to use as leverage.

By employing double extortion, the group offers different pricing options to the victim. These options typically involve different costs depending on whether the organization wants the attackers to delete the stolen data or to download and release it to the public. This method increases the pressure on the victim, as even if they can restore their systems from backups, they still face the threat of a public data leak that could damage their reputation and expose trade secrets.

Alleged compromised data types

While the total volume and specific count of the files stolen have not been disclosed by the group, sample documents have been shared in screenshots to prove the validity of the breach. The documents provided by the attackers suggest that the breach involves sensitive internal information. The following types of data are identified in the shared samples:

• Expense statements
• Technical equipment drawings

About Windak

Windak is a company that was founded in Sweden in 1994. The organization specializes in the manufacturing of cable packaging equipment. The company maintains its main office and primary operations in Conover, North Carolina, located within the United States.

Risk assessment and industry implications

The Medusa group is identified as a Ransomware-as-a-Service (RaaS) entity. This type of cybercriminal model involves developers who create the ransomware and