Millensys listed on Medusalocker ransomware leak site

• Ransomware group: Medusalocker
• Country: Brazil
• Sector: Technology
• Announcement date: October 5, 2026

Medusalocker claims Millensys data breach

The Medusalocker ransomware group has listed data allegedly belonging to Millensys on its leak site. According to the announcement made by the threat actor group, the organization has been targeted in a recent cyberattack. This type of activity is a common tactic used by ransomware groups who employ double extortion methods, where they not only encrypt an organization's data but also threaten to leak sensitive information on public platforms to pressure the victim into paying a ransom.

The announcement was made on October 5, 2026. The post claims that the group has successfully compromised specific credentials belonging to the organization. However, information regarding this specific group remains limited in the public domain, making it difficult to ascertain their full operational capabilities or specific motivations at this time.

Details of the claimed leak

The post provided by the Medusalocker group states that the breach involves specific organizational credentials. Based on the information released by the attackers, the following data types are claimed to have been leaked:

• Email addresses

While the group has posted an announcement, the provided visual evidence is limited. The screenshot shared by the attackers displays a browser verification page, which does not provide any visual evidence regarding the actual content or the extent of the leaked data. Furthermore, the group has not provided information regarding the total volume of data stolen, the specific number of files involved, or the ransom amount being demanded for the non-disclosure of the information.

About Millensys

Millensys is a healthcare technology company that develops medical imaging software, PACS, and RIS solutions for hospitals and radiology centers. Based in Egypt, it provides digital image management services to healthcare institutions globally.

Risk assessment and implications

This incident suggests that email accounts within Millensys may have been subject to unauthorized access. The leaked email addresses could be utilized for targeted phishing attacks against the organization's employees. Such attacks often use stolen credentials or contact information to craft highly convincing messages designed to trick employees into revealing further sensitive information or deploying malware within the corporate network.

As a secondary risk, such data could potentially serve as an entry point for infiltrating corporate networks. When attackers gain access to legitimate email addresses, they can bypass some traditional security perimeters, making the infiltration process more seamless and harder to detect. The limited information regarding the group's methods and motivations makes the overall risk assessment uncertain.

For organizations operating in Brazil, data breach notification obligations under the LGPD (General Data Protection Law) may arise following such an incident. In the broader technology and healthcare sectors, maintaining robust security postures is critical. Common defensive steps for organizations include implementing multi-factor authentication (MFA) to protect email accounts, conducting regular security awareness training to help employees recognize phishing attempts, and maintaining strict network segmentation to prevent lateral movement by attackers in the event of a successful breach.