Penticton and District Society for Community Living targeted by MedusaLocker

• Ransomware group: MedusaLocker
• Country: Canada
• Sector: Government & Defense
• Announcement date: July 1, 2026

MedusaLocker claims a data breach against Penticton and District Society for Community Living

The MedusaLocker ransomware group has listed the Penticton and District Society for Community Living on its dedicated leak site. According to the announcement made on July 1, 2026, the threat actor group alleges that they have successfully conducted a data breach against the organization. This type of activity is characteristic of modern ransomware operations, where attackers not only encrypt local systems but also exfiltrate sensitive information to use as leverage in extortion attempts.

The listing on the leak site serves as a public claim by the threat actors, asserting that they have gained unauthorized access to the organization's digital environment. While the group has published a list of files and samples that they purport to have stolen from the organization's servers, it is important to note that public information regarding the specific methods and capabilities of the MedusaLocker group remains limited.

Details of the claimed data theft

The information provided by the threat actors includes evidence intended to prove the validity of their claim. The group has shared screenshots that appear to display the contents of the compromised environment. Based on the available evidence, the breach involves specific directory structures and critical system files that suggest deep access into the organization's infrastructure.

The leaked content reportedly includes the following elements:

• Virtual disk files
• Server directory structures

Specifically, the shared screenshots show a file list that contains 'Shares/' and 'Users/' directories. Furthermore, the threat actors have pointed to specific virtual disk files, namely 'PDSCL-SQL01.VHDX' and 'PDSCL-RDS01_2.vhdx', as part of the stolen data. The presence of these files is significant, as virtual disks often contain entire operating systems, databases, and user profiles, potentially providing a gateway to vast amounts of sensitive information.

About the Penticton and District Society for Community Living

The Penticton and District Society for Community Living is a non-profit organization located in British Columbia, Canada. The organization plays a vital role in the community by providing essential support services for individuals living with disabilities. Their mission focuses on enhancing community inclusion and improving the overall quality of life for people with disabilities through various social programs.

Because the organization operates within the social services sector, the data they manage is often highly sensitive, involving the personal details and private information of vulnerable populations. This makes the security of their digital assets a critical component of their ability to provide safe and continuous support to their clients.

Potential impact and organizational risks

The alleged leak poses several significant risks to the organization. From an operational standpoint, such breaches can disrupt the continuity of essential services. Furthermore, the exposure of sensitive data can lead to severe privacy violations. As a Canadian organization, the Penticton and District Society for Community Living may be subject to strict data breach notification requirements under the Personal Information Protection and Electronic Documents Act (PIPEDA).

The exposure of virtual disk files is particularly concerning, as it may indicate that attackers have obtained access to highly sensitive data. This creates a high risk of secondary attacks, such as identity theft or highly targeted phishing campaigns against the organization's staff and the individuals they serve. Given the nature of the services provided, the leaked information could be extremely sensitive, potentially creating direct risks for the individuals receiving support from the society.

In general, organizations in the social services and government sectors can mitigate these risks by implementing robust defensive measures. These include maintaining offline backups, enforcing multi-factor authentication, and conducting regular security audits. As ransomware groups continue to use double extortion tactics—where data is both encrypted and stolen—maintaining strict data governance and monitoring for unauthorized access to sensitive directories and virtual disks remains a critical priority for cybersecurity defense.