San Jose Country Club targeted by Medusa ransomware group

• Ransomware group: Medusa
• Country: United States
• Sector: Hospitality
• Announcement date: June 9, 2025

Medusa ransomware group claims data breach at San Jose Country Club

The Medusa ransomware group has published an announcement on its leak site claiming to have exfiltrated a significant volume of data from the San Jose Country Club. According to the claim, the threat actor has successfully targeted the organization and is now threatening to release the stolen information unless specific demands are met.

Details of the alleged ransomware attack

The threat actor known as Medusa claims to have conducted a ransomware attack against the San Jose Country Club. In an announcement published on June 9, 2025, the group stated that it is demanding a ransom of 150,000 USD. The total volume of the alleged data leak is reported to be 117.5 GB. The attack was claimed to have taken place on June 9, 2025.

Ransomware attacks of this nature often involve a process known as double extortion. In this tactic, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of leaking this data on a public platform serves as additional leverage to pressure the victim into paying the ransom. This method increases the pressure on organizations, as the loss of data privacy can be just as damaging as the loss of operational access.

Potential data exposure and affected information

The screenshots provided by the threat actor display examples of the stolen information. Based on the evidence shared by the group, the breach involves sensitive records that could impact various stakeholders within the organization. The following types of data are reportedly included in the leak:

• Member contact information
• Employee records
• Address information

The exposure of such data, including contact details and addresses, can lead to secondary risks for the individuals involved. These risks often include identity theft and the likelihood of targeted phishing campaigns, where attackers use the stolen information to craft convincing fraudulent communications to further exploit the victims.

About San Jose Country Club

Established in 1899, San Jose Country Club is a private golf club located in San Jose, California. The facility provides its members with a golf course, dining services, and various social event spaces.

Analysis and organizational impact

Medusa is a Ransomware-as-a-Service (RaaS) group that has been active since 2021. As a RaaS entity, the group operates by providing ransomware tools to affiliates, who then carry out the actual attacks. This model allows the group to scale its operations significantly. This incident may pose secondary risks to members and employees, such as identity theft and targeted phishing campaigns.

Given the organization's location in the United States, the incident may trigger legal obligations under state-level data privacy regulations. Organizations facing such breaches often have to navigate complex regulatory landscapes to ensure they meet their notification and protection responsibilities. Furthermore, the threat actor's intent to publish the data could complicate the organization's ability to fulfill its data protection responsibilities.

The potential negative impacts on the organization's operational continuity and reputation may be observed following such an event. For organizations in the hospitality and private club sectors, maintaining member trust is paramount. A breach of this scale can lead to significant reputational damage and operational hurdles. To defend against such threats, organizations typically implement multi-layered security strategies, including robust backup solutions, network segmentation, and continuous monitoring to detect unauthorized data exfiltration before it reaches a critical volume.