Native Counselling Services of Alberta listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Canada
• Sector: Government & Defense
• Announcement date: October 23, 2023

The Medusa ransomware group has listed the Native Counselling Services of Alberta on its dedicated leak site. By appearing on this platform, the threat actor claims to have successfully exfiltrated data belonging to the organization, signaling a targeted cyberattack against the Canadian entity.

The details of the claim

According to the announcement made on October 23, 2023, the threat actor known as Medusa has issued a ransom demand against the organization. The group claims to be demanding a payment of 200,000 USD to prevent the release of the stolen information. The group has explicitly threatened to either publish the organization's data publicly or sell it to other malicious actors if the specified financial demand is not met.

Ransomware groups often utilize leak sites to apply psychological pressure on their victims. These sites serve as a public gallery for successful breaches, where groups post names of organizations to shame them into paying. This tactic is a core component of modern cyber extortion, aimed at maximizing the visibility of the breach to increase the likelihood of a payout.

Data samples and affected information

While the total volume of the stolen data and the exact file count have not been specified, the group has provided evidence of the breach through screenshots. These samples indicate that the stolen information includes various internal documents and sensitive administrative records. The specific types of data identified in the leak include:

• Employee agreements
• Internal correspondence
• Personnel lists

The presence of such documents suggests that the attackers have gained access to the internal administrative infrastructure of the organization, allowing them to access private communications and human resources documentation.

About Native Counselling Services of Alberta

Native Counselling Services of Alberta is a non-profit organization based in Canada. It provides essential legal and social support services specifically tailored to indigenous peoples in the Alberta region. The organization's primary mission is to facilitate access to the justice system and to work toward improving the overall social welfare of indigenous communities.

Risk assessment and implications

The Medusa group appears to be employing a double-extortion strategy. In this model, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data beforehand. This allows them to threaten the public disclosure of the information, creating a second layer of pressure. If the exfiltrated data is released, it could lead to significant risks for the organization's employees, such as identity theft and the threat of highly targeted phishing campaigns.

Because the organization operates within Canada, this breach may lead to legal consequences under local data protection regulations, such as the Personal Information Protection and Electronic Documents Act (PIPEDA). Furthermore, due to the sensitive nature of the social and legal services provided by the organization, the exposure of personal information could have a negative impact on public trust within the communities they serve.

Given the group's past activities, there is a high probability that the data will be leaked if the ransom is not paid. For organizations in the government and social service sectors, maintaining robust data protection measures is critical. Common defensive steps to mitigate such risks include implementing strict access controls, ensuring comprehensive encryption for data at rest and in transit, and maintaining rigorous employee training to recognize social engineering attempts. Because information regarding this specific group remains limited, organizations should remain vigilant against their evolving tactics.