Silknet Company listed on MedusaLocker ransomware leak site

• Ransomware group: MedusaLocker
• Country: United States
• Sector: Professional Services
• Announcement date: November 26, 2024

MedusaLocker claims to have stolen data from Silknet Company

The MedusaLocker ransomware group has published an announcement on their leak site claiming to possess data belonging to Silknet Company. This development follows a pattern of double extortion, a tactic where threat actors not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive information to use as leverage during ransom negotiations.

According to the announcement made on November 26, 2024, the MedusaLocker group claims to have targeted Silknet Company on the same day. The group asserts that they have successfully obtained over 3 TB of data from the company's internal systems. This massive volume of information is reportedly being offered for sale on the group's leak site. To facilitate the release or the sale of this alleged data, the attackers are demanding a ransom payment of 800,000 USD.

The alleged data involved in the breach

The information allegedly stolen by the MedusaLocker group is extensive and covers various critical business and personal datasets. The group claims that the breach includes approximately 1 TB of company email databases, which could contain sensitive internal communications. Furthermore, the stolen data is said to include:

• Customer data
• 2023-2044 company audit reports
• Passports
• Various corporate documents

The inclusion of highly sensitive documents like passports and audit reports significantly increases the severity of the incident, as these files often contain the core identity information of both employees and clients.

About Silknet Company

Silknet is a leading telecommunications company based in Georgia. The organization provides a wide range of essential services, including fixed-line, mobile, internet, and television services. Given the nature of its services, the company manages a vast amount of sensitive user information and critical communication infrastructure.

Potential impact and organizational risks

This incident may pose significant risks to the organization's operational continuity and data privacy. The alleged exposure of passports and customer data could lead to identity theft or targeted phishing attacks against the affected individuals. Because the organization is located in the US, legal processes may be triggered under data breach notification requirements and state-level privacy laws.

Considering the past activities of the MedusaLocker group, there is a possibility that the obtained data could be used for secondary extortion or shared on public platforms. Information about this specific group remains limited, making it difficult to predict their exact long-term behavior. In general, when organizations face such threats, they must prioritize incident response, forensic investigation, and robust communication strategies to mitigate damage. Protecting against such attacks typically requires a multi-layered defense strategy, including regular backups, strict access controls, and continuous monitoring of network traffic to detect unauthorized data exfiltration.