O'Shea Builders listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: United States
• Sector: Manufacturing
• Announcement date: March 29, 2025

Medusa claims attack on O'Shea Builders

The Medusa ransomware group has officially listed O'Shea Builders on its dedicated leak site. According to the announcement published on March 29, 2025, the threat actor group claims to have successfully targeted the organization and exfiltrated a significant volume of data. This development follows a pattern of double-extortion tactics commonly employed by modern ransomware collectives, where stolen information is used as leverage to pressure victims into paying a ransom.

The group alleges that the cyberattack against O'Shea Builders took place on March 28, 2025. Following the purported breach, the Medusa group has issued a ransom demand of 350,000 USD. The announcement was made via the group's public leak site, which serves as a platform for the group to claim responsibility for attacks and pressure organizations through public exposure.

Data and exfiltration details

Regarding the specific contents of the breach, the Medusa group claims to have stolen 120.50 GB of data from the organization. While the volume of the exfiltrated information has been specified, the group has not provided detailed information regarding the specific content or nature of the leaked data. The only evidence provided by the group in their announcement is a screenshot containing a verification page.

The listing names no specific data types that have been compromised.

About O'Shea Builders

O'Shea Builders is a commercial construction services provider based in the United States, specifically operating out of Illinois. Founded in 1902, the company has a long-standing history in the industry. The organization provides a wide range of services, including general contracting, construction management, design-build, and building maintenance services.

Impact and security implications

The claim made against O'Shea Builders carries potential consequences for the organization's operational continuity and its commercial reputation. Because the entity is based in the United States, the incident may trigger legal processes under federal regulations as well as state-level data breach notification laws. Such legal frameworks are designed to ensure that affected parties are informed when sensitive information is compromised.

The use of double-extortion tactics by the Medusa group suggests that the stolen data could potentially be utilized for secondary risks. These risks include identity theft or the execution of targeted phishing attacks against the organization or its associates. Furthermore, the possibility of the exposure of employee and customer data may pose significant risks to the security of the organization's supply chain.

In general, when organizations face such threats, maintaining robust defensive postures is critical. This typically involves implementing multi-factor authentication, maintaining regular offline backups, and conducting regular employee security awareness training to mitigate the risk of initial access via phishing. For companies in the manufacturing and construction sectors, protecting the integrity of the supply chain and ensuring the confidentiality of project-related data is paramount to maintaining trust with clients and partners.