R&W Engineering targeted by Medusa ransomware group

• Ransomware group: Medusa
• Country: United States
• Sector: Manufacturing
• Announcement date: July 6, 2025

The Medusa ransomware group has published a claim on its leak site involving R&W Engineering. The threat actors have listed a significant amount of data, claiming it belongs to the Oregon-based organization.

Details of the claimed attack

According to the announcement made on July 6, 2025, the Medusa group claims to have conducted a ransomware attack against R&W Engineering. The threat actors allege that the breach occurred around June 13, 2025. The group has listed 676.5 GB of data on their leak site, which they claim was obtained directly from the organization's internal systems.

In line with modern cyber extortion trends, the group is employing double extortion tactics. This method involves not only encrypting an organization's files to disrupt operations but also stealing sensitive information to use as leverage. By threatening to release the stolen data publicly, the attackers aim to increase the pressure on the victim to comply with their demands. In this specific instance, the Medusa group is demanding a ransom of 100,000 USD to prevent the publication of the stolen information.

Data and information involved

The leak site provides various screenshots intended to prove the validity of the theft. These visual samples indicate that the stolen information includes sensitive corporate documentation. Based on the available evidence, the following types of data are identified as being affected:

• Insurance documents
• Project budget plans

The presence of such documents, specifically certificates of liability insurance and project budget plans, suggests that the breach may expose critical financial and legal information essential to the company's business operations and contractual obligations.

About R&W Engineering

R&W Engineering is an engineering firm based in Oregon, United States. The company provides specialized engineering and design services for a variety of high-stakes environments, including industrial facilities, energy systems, and various infrastructure projects.

Potential impact and industry implications

This leak may pose a risk of exposure for sensitive corporate data and trade secrets within R&W Engineering. Given the Medusa group's use of double extortion tactics, the publication of this data could lead to significant reputational damage and operational disruptions for the organization. As a US-based entity, the incident may result in legal consequences under state-level data protection laws and industry-specific regulations.

Furthermore, there is a possibility that the information contained in the leaked documents could be exploited by third parties for targeted phishing or corporate espionage activities. When sensitive documents like budget plans or insurance certificates are leaked, they provide attackers with the necessary context to craft highly convincing social engineering attacks against employees or partners.

For organizations operating in the manufacturing and engineering sectors, such incidents highlight the importance of robust cybersecurity frameworks. To defend against such threats, organizations typically focus on implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of phishing. Additionally, monitoring for unauthorized data exfiltration and ensuring strict access controls for sensitive project files are standard defensive measures used to protect intellectual property and corporate integrity.