MedusaLocker claims data breach against dulay.ca

• Ransomware group: MedusaLocker
• Country: Canada
• Sector: Technology
• Announcement date: November 18, 2025

MedusaLocker claims to have compromised dulay.ca

The MedusaLocker ransomware group has published an announcement on its leak site claiming to have compromised data belonging to dulay.ca. According to the post, which was listed on November 18, 2025, the group asserts it has successfully conducted a ransomware attack against the organization.

Ransomware attacks often involve a process known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information before the encryption phase. This allows the attackers to threaten the public release of stolen data if the ransom is not paid, creating additional pressure on the victim organization. This tactic significantly increases the impact of the incident, as the threat shifts from simple operational downtime to a long-term data privacy crisis.

Details of the claimed attack

The MedusaLocker group alleges that the attack took place on November 17, 2025. Through this breach, the group claims to have exfiltrated approximately 500 GB of data. To facilitate the return of the stolen information, the attackers are demanding a ransom payment of 40,000 USD.

The group's announcement includes a screenshot of a file directory, which provides a glimpse into the types of information they claim to have accessed. The directory structure suggests that the stolen data is highly sensitive and contains a variety of administrative and personal records. The information identified in the screenshot includes:

• Financial records
• Employee payroll data
• Tax documents
• Client files

The presence of such diverse documentation, ranging from invoices and payroll records to tax documents like T4, T5, and HST, as well as various workflow documents, indicates a significant breach of internal organizational processes.

Potential impact and risks

This incident presents a significant risk of exposure for sensitive corporate and personal data held by dulay.ca. Because the organization operates in Canada, the breach may trigger legal proceedings regarding data privacy violations under the Personal Information Protection and Electronic Documents Act (PIPEDA). Such regulatory scrutiny often follows when personal identifiers or financial information are compromised.

The exposed data could potentially facilitate secondary malicious activities, such as identity theft or highly targeted phishing attacks directed at the employees and clients of the organization. Furthermore, the group has indicated an offer to sell the data to a single buyer, which increases the risk of secondary extortion. In such cases, an organization might face multiple waves of demands from different threat actors interested in the same dataset.

Defensive considerations for technology organizations

For organizations operating within the technology sector, incidents of this nature underscore the necessity of robust data protection strategies. While information regarding this specific group remains limited, the threat they pose is consistent with modern ransomware trends. Organizations can mitigate these risks by implementing strict access controls, ensuring comprehensive logging and monitoring of data movement, and maintaining offline, immutable backups.

Furthermore, proactive measures such as regular security awareness training can help defend against the phishing elements often used in the aftermath of a breach. As attackers increasingly target specific data types to maximize extortion leverage, maintaining a clear inventory of where sensitive information resides is a critical component of a modern cybersecurity posture.