White Coffee Corporation targeted by Medusa ransomware group

• Ransomware group: Medusa
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: August 2, 2025

Medusa ransomware group claims data breach at White Coffee Corporation

The threat actor known as Medusa has published an announcement on its leak site, claiming to have exfiltrated a significant amount of data from White Coffee Corporation. According to the group's post, the alleged attack occurred on July 30, 2025, with the public announcement appearing on their platform on August 2, 2025. The group claims to have obtained approximately 88.40 GB of data from the organization's networks.

This incident follows a pattern often seen in modern cyberattacks where threat actors utilize leak sites to exert pressure on their victims. In such scenarios, the attackers typically employ double-extortion tactics. This method involves two stages: first, encrypting the victim's systems to disrupt operations, and second, threatening to release sensitive stolen data on public forums if a ransom is not paid. By threatening to leak information, the attackers aim to maximize the leverage they hold over the target organization.

Details of the alleged extortion attempt

The Medusa ransomware group has stated that they are demanding a ransom of 100,000 USD in exchange for the non-disclosure of the allegedly stolen information. The group's listing serves as a public ultimatum, a common tactic used to induce panic and force a quick payment. The threat actor claims that the data was extracted directly from the corporate networks of the victim.

The group's claims regarding the breach involve several types of documentation. Based on the screenshots provided by the attackers, the stolen information reportedly includes:

• Laboratory analysis reports
• Corporate documents

The presence of such documents in a leak site announcement suggests that the attackers have access to internal operational files, which can be highly sensitive for a company's business processes.

About White Coffee Corporation

White Coffee Corporation is a family-owned business with over 85 years of experience in its industry. The company specializes in coffee roasting and co-packing services, catering to beverage brands, hospitality providers, and various entrepreneurs. Operating out of the Astoria area of New York, the organization plays a role in the food production and supply chain through its specialized services.

Potential impact and industry implications

This incident, as alleged by the Medusa group, could have significant consequences for the organization. The potential exposure of sensitive documents may negatively impact the company's operational continuity and its commercial reputation. Because the leaked content may contain information regarding the company's supply chain and business partners, the breach could lead to secondary risks for those third-party entities as well.

Furthermore, since the organization is based in the United States, a confirmed data breach could trigger various legal obligations under relevant state laws and federal regulations. Organizations operating in the food and beverage sector must be particularly mindful of the sensitive nature of their supply chain data and corporate documentation.

The publication of such data can facilitate further criminal activities, such as identity theft or highly targeted phishing attacks against the company or its partners. In general, when organizations face such threats, they often need to initiate forensic investigations to determine the full scope of the breach. Such investigations are critical for understanding how the perimeter was breached and what specific data was accessed. Additionally, notifying relevant stakeholders is a standard procedure to mitigate the impact of the exposure and maintain transparency with partners and customers.