Novus International targeted by Medusa ransomware group

• Ransomware group: Medusa
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: April 13, 2024

Medusa ransomware group claims data breach at Novus International

The Medusa ransomware group has listed data allegedly belonging to Novus International on its leak site. According to the announcement made on April 13, 2024, the group claims to have targeted the organization on April 12, 2024. This claim involves a significant volume of information, which the group asserts is part of a successful data exfiltration operation.

Details of the claimed attack

The Medusa ransomware group is a known threat actor that has been active since 2021. Following the launch of its dedicated leak site in 2023, the group has adopted the double extortion method. In such attacks, threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage, threatening to publish it on a public leak site if a ransom is not paid.

The current claim suggests that the breach involves 151.3 GB of data. However, there is no detailed information regarding the specific content of the allegedly leaked data. Furthermore, no screenshots have been provided by the group to verify the nature of the files or the validity of the claim.

Organization profile

Novus International is a company that specializes in creating animal nutrition solutions. Their products are designed for livestock, poultry, and aquaculture sectors. Founded in 1991, the organization is headquartered in Saint Charles, Missouri, United States.

Potential impact and security considerations

This claim may lead to the exposure of sensitive data within the organization. Until the content of the data is clarified, it may be assessed that critical information such as employee records or trade secrets could be at risk. Because the organization is based in the United States, a potential data breach may trigger legal processes under state-level privacy laws and relevant regulations.

Given the Medusa group's use of the double extortion method, there is a possibility that the leaked data could be used for secondary attacks or targeted phishing campaigns. In such scenarios, stolen information is often used to craft highly convincing fraudulent communications to deceive employees or partners.

General defensive measures

When organizations face threats from ransomware groups utilizing double extortion, several defensive strategies are commonly discussed in the cybersecurity industry. Maintaining robust, offline backups is a fundamental step in ensuring operational continuity. Additionally, implementing strict access controls and multi-factor authentication can help limit the movement of attackers within a network. Organizations also benefit from continuous monitoring of their digital perimeter to detect unauthorized data exfiltration attempts early. Regular security awareness training is also vital to help employees recognize and avoid the phishing attempts that often follow a data breach.