Team Group listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Thailand
• Sector: Manufacturing
• Announcement date: September 3, 2025

Medusa ransomware group targets Team Group

The Medusa ransomware group has officially listed the Thailand-based integrated engineering firm, Team Group, on its dedicated leak site. According to the announcement made on September 3, 2025, the threat actors claim to have successfully breached the organization's systems and exfiltrated a significant volume of sensitive information.

The breach, which the group claims occurred on September 1, 2025, involves a massive amount of data. The attackers assert that they have stolen approximately 2.25 TB of information from the company's infrastructure. This type of public listing is a hallmark of modern ransomware operations, where groups use the threat of leaking stolen data to pressure victims into paying a ransom.

Details of the alleged data theft and ransom demand

The Medusa group has issued a specific ransom demand in connection with this incident. The announcement states that the threat actors are requesting a payment of 200,000 USD to prevent the further release of the stolen data. This follows a common pattern in ransomware-as-a-service (RaaS) operations, where the objective is to maximize financial gain through extortion.

While the total volume of the alleged leak is stated to be 2.25 TB, the group has provided specific visual evidence to support their claims. The screenshots included in the leak site announcement reportedly display various sensitive materials, including samples of identification cards and a variety of corporate documents. The specific types of data affected include:

• Identity information
• Corporate documents

About Team Group

Team Group is an integrated engineering firm headquartered in Thailand. The organization provides a wide range of comprehensive consulting services across multiple critical sectors, including building, infrastructure, water resources, environmental management, transport, and energy. With a professional history spanning over 40 years, the company has established itself as a specialist in managing large-scale projects throughout the region.

Analysis and potential implications of the breach

The Medusa group, which has been active since 2021, is known for employing double-extortion tactics. In a double-extortion scenario, attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information beforehand. This allows them to threaten the victim with the public release of the data if the ransom is not paid, creating a secondary layer of pressure that targets the organization's reputation and legal standing.

The implications of this specific breach are multifaceted. For an organization like Team Group, which operates in the consulting sector, the leak of corporate documents and identity information could potentially compromise supply chain security. Furthermore, the exposure of personal identity information poses significant secondary risks to the organization's employees and clients, such as the potential for identity theft or highly targeted phishing attacks.

From a regulatory perspective, the organization may face legal and administrative consequences due to the nature of the data involved and the jurisdiction in which it operates, specifically regarding data protection regulations in Thailand. The group's history suggests a strong tendency to exert pressure through the publication or sale of stolen data to ensure compliance with their demands.

In general, organizations facing such threats often focus on defensive strategies such as implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access. In the wake of a confirmed breach, organizations typically engage in incident response protocols to contain the threat and assess the full scope of the data exposure.