Oscars Group listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Australia
• Sector: Hospitality
• Announcement date: November 7, 2025

Medusa ransomware group targets Oscars Group

The Medusa ransomware group has listed data allegedly belonging to the Australian hospitality company Oscars Group on its dedicated leak site. The announcement, which appeared on the leak site on November 7, 2025, follows a claimed attack date of November 5, 2025. The threat actor is reportedly demanding a ransom of 100,000 USD from the organization to prevent the further release of stolen information.

Ransomware attacks of this nature often involve a process known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The threat actors then use the threat of leaking this information on public forums or leak sites to pressure the victim into paying the ransom. This tactic significantly increases the pressure on an organization, as the loss of data can lead to severe regulatory, legal, and reputational consequences that persist even if systems are successfully restored from backups.

Details of the alleged data breach

The announcement made by the Medusa group includes various screenshots intended to prove the validity of the breach. These images display tables that appear to contain the institution's operational records. Based on the visual evidence provided by the attackers, the leaked information is said to include sensitive internal documentation. Specifically, the screenshots display tables that appear to contain the following types of data:

• Employee payroll records
• Staff contact information
• Financial data

While the threat actor has provided these visual proofs, the total size of the stolen dataset and the exact number of files involved have not been disclosed in the announcement. The presence of such sensitive information in the hands of a ransomware group poses a significant risk to the individuals involved, as it can be used for further malicious activities.

About Oscars Group

Oscars Group is a prominent hospitality and entertainment company operating within New South Wales, Australia. Founded in 1986 by the Gravanis brothers, the group has established a significant presence in the region. The organization manages a diverse portfolio of over 35 venues, which includes hotels, pubs, event centers, and various residential developments.

Risk assessment and organizational implications

The Medusa group is recognized as a Ransomware-as-a-Service (RaaS) operation that frequently employs double extortion tactics against its targets. The data allegedly leaked in this instance, which includes payroll and contact details, may increase the risk of identity theft and targeted phishing attacks against the company's employees. When personal and financial information is compromised, attackers often use it to craft highly convincing social engineering campaigns aimed at employees or other business partners.

From a regulatory perspective, the organization may face significant obligations. Under the Australian Privacy Act 1988, the company may be required to fulfill specific data breach notification obligations to both regulators and affected individuals. Furthermore, the pressure to maintain operational continuity while facing the potential public release of sensitive data can lead to substantial reputational damage and legal sanctions. The possibility of the full dataset being released publicly remains a high risk if the ransom demand is not met, given the group's historical patterns of activity.

For organizations operating in the hospitality sector, which often handle large volumes of personal and financial data, maintaining robust cybersecurity defenses is critical. This includes implementing multi-factor authentication, maintaining offline backups, and conducting regular employee training to recognize phishing attempts. As ransomware groups continue to refine their extortion methods, the ability to detect unauthorized data exfiltration and respond quickly to incidents remains a primary defense against the long-term impacts of a breach.