Universidade Municipal de São Caetano listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Brazil
• Sector: Education
• Announcement date: November 30, 2025

Medusa ransomware group targets Universidade Municipal de São Caetano

The Medusa ransomware group has officially listed the Universidade Municipal de São Caetano on its dedicated leak site. By doing so, the threat actor claims to have successfully compromised the institution's systems and acquired sensitive data belonging to the university.

According to the information provided by the group, the cyberattack is reported to have occurred on November 24, 2025. The group's announcement on their leak site was made on November 30, 2025. In their communication, Medusa has demanded a ransom payment of 250,000 USD to prevent the public release of the stolen information. This type of extortion is a hallmark of modern ransomware operations, where attackers threaten to publish sensitive files to pressure the victim into paying.

Data types involved in the claimed breach

While the total volume of the stolen data and the exact number of files have not been specified, the group has provided visual evidence through screenshots. These samples indicate that the breach involves various types of sensitive information. Based on the leaked samples, the following data types are reportedly included in the breach:

• Participant lists
• Address information
• Contact data

The exposure of such information poses significant risks to the individuals involved, as it provides a roadmap for further malicious activities. The presence of personal contact details and addresses is particularly concerning for the privacy of the university community.

About Universidade Municipal de São Caetano

Universidade Municipal de São Caetano (USCS) is a higher education institution located in São Caetano do Sul, Brazil. The university offers a wide range of academic programs, including undergraduate, postgraduate, MBA, and doctoral degrees. Beyond its core academic offerings, the institution provides technical education and various community services to the region.

Analysis and potential impact of the attack

The Medusa group is a known cyber threat actor that has been active since 2021. The group is known for employing double-extortion tactics, a method where attackers not only encrypt an organization's data to disrupt operations but also steal the data beforehand to threaten its public release. This dual pressure significantly increases the likelihood of a ransom payment, as organizations fear the reputational and legal consequences of a data leak.

The potential leak of university data carries several severe risks. For students and staff, the exposure of personal information significantly increases the risk of identity theft and targeted phishing campaigns. Furthermore, because the university provides legal and health services, the exposure of data related to these sectors could result in the disclosure of highly sensitive personal information. Such a breach could lead to significant privacy violations for the individuals relying on these services.

From a regulatory perspective, the institution may face legal sanctions under Brazil's LGPD (Lei Geral de Proteção de Dados) regulations due to this data security breach. The legal frameworks governing data protection in Brazil place significant responsibility on organizations to secure personal information against unauthorized access.

The group's history suggests that if the ransom demand is not met, the entire dataset may be released to the public. To defend against such threats, organizations in the education sector typically focus on implementing robust security measures. These include maintaining regular, offline backups to ensure data can be restored without paying a ransom, implementing multi-factor authentication (MFA) across all systems, and conducting regular security awareness training for staff and students to recognize phishing attempts. Additionally, maintaining strict network segmentation and monitoring for unusual data exfiltration patterns are critical defensive steps to mitigate the impact of such sophisticated threat actors.