Safco International Gen Trading listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: United Arab Emirates
• Sector: Agriculture and Food Production
• Announcement date: January 24, 2025

Medusa ransomware group claims data breach at Safco International Gen Trading

The Medusa ransomware group has listed Safco International Gen Trading on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully exfiltrated a significant volume of data from the organization's systems. This development highlights the ongoing threat posed by ransomware groups that target various industrial sectors to exert pressure on their victims.

Details of the alleged attack

The threat actor announced the incident on January 24, 2025, claiming that the initial attack occurred on January 18, 2025. The Medusa group, which has been under monitoring by security researchers since 2021, is known for employing double-extortion tactics. In a double-extortion scheme, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information, threatening to leak it publicly if a ransom is not paid. This method increases the leverage the attackers hold over the victim.

The group claims to have obtained 506.9 GB of data from the company. While the volume of the data is specified, the group has not provided any detailed information regarding the specific content of the leaked files, and no screenshots have been provided to verify the nature of the stolen information. Furthermore, no specific ransom demand has been made public in the current listing.

Organization profile

Safco International Gen Trading is a food manufacturer and supplier based in the United Arab Emirates. The company specializes in providing products and services for the FoodService and HoReCA (hotel, restaurant, cafe) industries.

Potential impact and industry implications

This alleged data leak may create negative impacts on the company's operational processes. Depending on the nature of the data involved, there could be a risk of exposure for employee or business partner information. Given the Medusa group's known use of double-extortion tactics, the company may be susceptible to secondary attacks or targeted phishing attempts resulting from the stolen information.

Furthermore, as the company operates within the food supply chain, this incident could potentially lead to long-term consequences for its commercial reputation. Organizations operating within critical supply chains, such as food production, face unique challenges when targeted by cybercriminals. A breach in these sectors can disrupt the flow of goods and erode the trust of business partners and consumers alike.

To mitigate such risks, organizations in the food and supply chain sectors often focus on strengthening their defensive postures. Common defensive steps include implementing robust multi-factor authentication, maintaining regular offline backups, and conducting thorough employee training to recognize phishing attempts. Additionally, continuous monitoring of network traffic and maintaining a comprehensive incident response plan are essential components of a modern cybersecurity strategy designed to defend against sophisticated ransomware groups.