Thunder Bay Counselling listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Canada
• Sector: Government & Defense
• Announcement date: December 19, 2025

The Medusa ransomware group has listed Thunder Bay Counselling on its dedicated leak site, claiming to have obtained the organization's data. This announcement, posted on December 19, 2025, follows an alleged attack that occurred on December 13, 2025. The listing indicates a significant breach of confidentiality for the Canadian-based institution.

The details of the claim

According to the announcement made by the Medusa ransomware group, the organization is being targeted in a data breach. The group has issued a specific ransom demand of 100,000 USD from Thunder Bay Counselling. The group's post suggests that the institution's data has been compromised during the incident. Furthermore, the threat actors have initiated a countdown timer, a common tactic used by ransomware groups to pressure victims into meeting their financial demands before the stolen information is released to the public.

Ransomware groups often utilize leak sites to host information stolen during an intrusion. These sites serve as a public pressure mechanism. When a group employs double-extortion tactics, they do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data. This allows them to threaten the victim with the public release of private information, creating a secondary layer of leverage to ensure the ransom is paid. If the ransom is not met, the group typically proceeds to leak the data on their platform.

Data samples and affected information

The group has provided screenshots as evidence of the breach. These visual samples suggest that the compromised information includes various sensitive documents used for business and administrative operations. Based on the available evidence, the following types of data are identified as being involved in the claim:

• Service contracts
• Employee lists
• Administrative documents

The presence of such documents indicates that the breach may involve sensitive internal information and potentially personal details of individuals associated with the organization.

About Thunder Bay Counselling

Thunder Bay Counselling is an organization that provides counseling, psychotherapy, and educational services to individuals, families, and businesses. It aims to improve overall community well-being by offering support for mental health, substance use, and workplace challenges.

Analysis and potential consequences

The Medusa group is recognized as a Ransomware-as-a-Service (RaaS) operation. Such groups operate by providing specialized ransomware code to affiliates who then carry out the actual attacks. The use of double-extortion tactics by Medusa poses a high risk to the organization. The potential leak of the claimed data could lead to the exposure of personal information belonging to both employees and service recipients.

Because the organization operates in Canada, the potential exposure of such data may lead to legal consequences under data protection regulations, such as the Personal Information Protection and Electronic Documents Act (PIPEDA). Beyond legal and regulatory risks, the exposed data may create significant risks for identity theft and targeted phishing attacks against the individuals whose information was compromised. When sensitive administrative and service-related documents are leaked, attackers can use the details to craft highly convincing social engineering campaigns.

For organizations operating in sensitive sectors, such as those providing mental health and community support, maintaining robust cybersecurity defenses is critical. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for staff to recognize phishing attempts. Given the history of the Medusa group, there is a high possibility that the data will be made public if the ransom demand is not met.