MedusaLocker claims data leak involving wellons.org

• Ransomware group: MedusaLocker
• Country: United States
• Announcement date: October 23, 2023

MedusaLocker claims data leak involving wellons.org

The MedusaLocker ransomware group has announced a data leak on their dedicated leak site, claiming to have compromised sensitive information allegedly belonging to wellons.org. This announcement, made on October 23, 2023, follows a claimed attack date of the same day. The threat actors assert that they have successfully exfiltrated a significant volume of data from the organization.

Details of the alleged breach

According to the claims made by the MedusaLocker group, the breach involves approximately 15 GB of data. The threat actors are utilizing a double-extortion tactic, a method where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage. In this instance, the group is demanding a ransom of 55,000 USD in exchange for the return or non-disclosure of the stolen information.

The announcement specifies that the exfiltrated files include various types of sensitive corporate and personal information. The listed data types include:

• Employee contact information
• Contract documents
• Customer email data
• Corporate email correspondence

Furthermore, the group claims to have obtained .pst files containing Outlook messages spanning from 2006 to 2023, as well as customer email lists in .xls format. This long-term access to email archives suggests a deep intrusion into the organization's communication history.

About wellons.org

Wellons is an engineering and manufacturing company that specializes in industrial wood processing, energy systems, and drying technologies. The company provides turnkey solutions, particularly for the lumber industry, such as power plants and drying kilns.

Risk assessment and implications

The alleged leak of this data presents several significant risks to the organization. The exposure of employee contact information and corporate email correspondence increases the risk of identity theft or targeted phishing attacks against both the organization's employees and its business partners. Such attacks often leverage stolen context to gain further access to secure systems.

Additionally, the exfiltration of contract and email data could pose secondary risks to the organization's commercial operations and the security of its supply chain. Because the organization is based in the United States, this incident may trigger legal obligations under relevant state laws and various data protection regulations.

While public information regarding the MedusaLocker group remains limited, their use of double-extortion tactics indicates that the publication of this data is likely intended to exert maximum pressure on the organization. In such scenarios, organizations typically focus on incident response, forensic investigation, and strengthening defensive postures to mitigate the impact of both the initial intrusion and the subsequent data exposure.