Premiumfruits listed on Medusalocker leak site

• Ransomware group: Medusalocker
• Country: Spain
• Sector: Agriculture and Food Production
• Announcement date: September 28, 2026

The Medusalocker ransomware group has officially listed the Spanish agricultural and food production company Premiumfruits on its leak site. According to the announcement made on September 28, 2026, the threat actor claims to have successfully compromised and exfiltrated data belonging to the organization. This development follows a pattern common in modern cyberattacks, where threat actors use dedicated leak sites to pressure victims by threatening to release sensitive information.

The alleged breach and group details

The threat actor known as Medusalocker has posted an announcement claiming responsibility for the attack on Premiumfruits. The announcement alleges that a specific set of data has been stolen from the company's systems. While the claim has been made public, information regarding the Medusalocker group remains limited in the public domain, making it difficult to ascertain their specific tactics, techniques, or long-term objectives beyond their typical extortion activities.

In many modern ransomware operations, groups employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt a victim's files to disrupt operations; they also steal sensitive data beforehand. The threat of leaking this stolen information on a public platform serves as additional leverage to compel the organization to pay a ransom. This method increases the pressure on the victim, as the loss of data can lead to regulatory scrutiny, reputational damage, and operational complications that persist even after systems are restored from backups.

Claimed data and evidence

The announcement from the Medusalocker group specifies the nature of the data they claim to have exfiltrated. According to the group, the stolen information consists of a specific set of contact information. The details provided in the leak site listing include:

• Email addresses

The group has provided a screenshot as part of their announcement; however, this image displays only a browser verification page. Consequently, the provided evidence does not contain any concrete samples or verifiable portions of the leaked files. It is important to note that the accuracy and the actual scope of the data claimed by the group have not been independently verified by external parties.

About Premiumfruits

Premiumfruits is an agricultural and food company based in Spain. The organization specializes in the trade and export of fresh fruits and vegetables, operating within the critical agriculture and food production sector. As an entity involved in international trade, the company manages various logistical and commercial data flows necessary for the global distribution of fresh produce.

Impact assessment and defensive considerations

The alleged exfiltration of email addresses presents significant risks to the organization. Such data can be utilized by threat actors to facilitate highly targeted phishing campaigns directed at the organization's employees or its customers. These social engineering attacks often aim to harvest further credentials or deploy malware, potentially opening doors for secondary attack vectors that could further compromise the organization's digital assets.

Because Premiumfruits is based in Spain, this incident may trigger mandatory data breach notification requirements under the General Data Protection Regulation (GDPR). Organizations operating within the European Union must adhere to strict protocols regarding the reporting of personal data breaches to ensure transparency and consumer protection.

For organizations in the agriculture and food production sector, maintaining robust cybersecurity posture is essential. Common defensive steps include implementing multi-factor authentication (MFA) across all external-facing services, conducting regular security audits of internal systems, and maintaining comprehensive employee training programs to recognize phishing attempts. Given that the scope of this specific breach remains unconfirmed, a comprehensive security audit of internal systems is often recommended to identify potential vulnerabilities and mitigate the risk of subsequent attacks.