Ransomware Group: MEDUSA

VICTIM NAME: Compass Group (2nd attack)

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the MEDUSA Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page details a second attack on a hospitality and tourism organization in Australia, identified as Compass Group. The associated group with this breach is named Medusa. The compromise was discovered on September 19, 2024, although specific details regarding prior breaches remain unspecified. Within this particular leak, it was highlighted that the company had inadequately managed their network security. As stated in a report from the attackers, the firm’s network administrators had deployed security software (Crowdstrike Falcon EDR) in an attempt to mitigate threats; however, their efforts were deemed insufficient, allowing the attackers continued access.

The leak page also points out the organization’s lack of concern for customer privacy and security, describing it as one of the poorest in terms of network administration in Australia. Included in the leaked content are statistics concerning the organization’s employees, third-party services, and user data, which suggest a significant number of individuals and external entities may have been affected. The page includes screenshots that likely reveal internal documents or network information pertinent to the ongoing attacks. Additionally, download links are mentioned, implying further sensitive data may be accessible, although specific contents are not disclosed. This incident further emphasizes the ongoing vulnerabilities faced by companies in maintaining robust cybersecurity measures.