medusalocker ransomware group lists 瑞祥机电 (Ruixiang Jidian) on its leak site

• Ransomware group: medusalocker
• Country: China
• Sector: Manufacturing
• Announcement date: September 12, 2026

Medusalocker claims data breach at Ruixiang Jidian

The Medusalocker ransomware group has officially listed the Chinese manufacturing firm 瑞祥机电 (Ruixiang Jidian) on its dedicated leak site. According to an announcement published by the threat actors on September 12, 2026, the group claims to have successfully compromised the organization's digital environment. This development follows a pattern common in modern cyberattacks, where ransomware groups utilize leak sites to pressure victims by threatening to release sensitive information if demands are not met.

The threat actors allege that they have gained unauthorized access to the organization's network infrastructure and operational data. This type of claim is a hallmark of double extortion tactics, where attackers not only encrypt systems to disrupt operations but also exfiltrate data to use as leverage. By threatening to publish stolen information, these groups aim to maximize their influence over the victim organization.

Details regarding the alleged data compromise

While the Medusalocker group has made public claims regarding the breach, specific details concerning the contents of the stolen information remain unavailable. The announcement provided by the group does not include specific document content or a breakdown of the types of files accessed. Instead, the evidence provided by the attackers consists only of a browser verification screen, which serves as a method to prove their access to the victim's environment.

The listing names no specific data types that have been compromised.

The nature of the threat actor

Publicly available information regarding the Medusalocker group is currently limited. Ransomware groups like this often operate with varying degrees of sophistication, and their methods can evolve over time. The use of leak sites is a standard operational procedure for such groups, serving as a public bulletin board to announce their targets and the status of their negotiations.

Profile of Ruixiang Jidian

Ruixiang Jidian is a prominent Chinese company operating within the manufacturing sector. The organization specializes in the production of elevators and operates under the Yinhai brand. Their product portfolio includes the manufacturing of machine-room-less passenger elevators.

Beyond their own brand, Ruixiang Jidian serves as a critical supplier within the global elevator industry. The company produces and supplies essential elevator components to several major international brands, including OTIS, KONE, Hitachi, Toshiba, and TKS. This position in the manufacturing hierarchy places them as a key player in the supply chain for global elevator technology.

Potential risks and industry implications

The potential compromise of data related to Ruixiang Jidian's manufacturing processes and commercial partnerships may pose significant risks to supply chain security. Because the organization acts as an Original Equipment Manufacturer (OEM) for global industry leaders such as OTIS, KONE, and Hitachi, this incident could lead to a loss of commercial reputation. When a supplier to major global brands is targeted, the ripple effects can extend throughout the entire industry's supply chain.

Furthermore, the organization may face legal obligations under data protection regulations in China. Beyond the immediate legal concerns, there are inherent risks of secondary attacks following such a breach. Organizations in the manufacturing sector can mitigate these risks by implementing robust security frameworks, emphasizing network segmentation to protect operational technology, and maintaining strict oversight of third-party access to ensure supply chain integrity.