Medusa
Data as of August 16, 2026.
Credential exposure before the attack
30.9% of Medusa victims whose domain we can identify (167 of 540) had employee credentials leak in the 12 months before Medusa named them as a victim.
We don't know whether any of these credentials were how Medusa gained initial access.
What industries Medusa targets
Sector identified for 315 of 540 victims.
| Manufacturing | 52 | |
| Healthcare | 47 | |
| Education | 42 | |
| Financial Services | 32 | |
| Construction | 23 | |
| Technology | 20 | |
| Retail | 17 | |
| Logistics | 14 |
Where the victims are located
Country identified for 217 of 540 victims.
| United States | 66 | |
| United Kingdom | 23 | |
| Canada | 18 | |
| Italy | 13 | |
| Brazil | 12 | |
| Australia | 12 | |
| Germany | 9 | |
| France | 9 |
Most recent Medusa victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Walman Optical walman.com | Not identified | United States | Apr 27, 2026 |
| NEMR nemr.net | Telecommunications | United States | Apr 14, 2026 |
| TouchSource touchsource.com | Technology | United States | Apr 6, 2026 |
| Big Thumb schlamstone.com | Not identified | United States | Mar 30, 2026 |
| Cape May County New Jersey capemaycountynj.gov | Government | United States | Mar 26, 2026 |
| Lorain County Community College lccc.edu | Education | United States | Mar 26, 2026 |
| LiveCH livech.com | Not identified | Switzerland | Mar 26, 2026 |
| Bonanza Casino bonanzacasino.com | Not identified | Netherlands | Mar 18, 2026 |
| Cape May County capemaycountynj.gov | Government | United States | Mar 18, 2026 |
| Lehigh Carbon Community College lccc.edu | Education | United States | Mar 18, 2026 |
| Passaic County passaiccountynj.org | Government | United States | Mar 18, 2026 |
| University of Mississippi Medical Center umc.edu | Healthcare | United States | Mar 12, 2026 |
| Acme Trucking acmetruck.com | Logistics | United States | Mar 3, 2026 |
| IPG ipgltd.com | Financial Services | United Kingdom | Mar 3, 2026 |
| Shaft Drillers shaftdrillers.com | Not identified | United States | Mar 3, 2026 |
| Amevida amevida.de | Not identified | Germany | Feb 26, 2026 |
| Chartre Consulting chartre.com | Retail | United States | Feb 26, 2026 |
| ToolPartsPro toolpartspro.com | Retail | United States | Feb 26, 2026 |
| Aramsco aramsco.com | Not identified | United States | Feb 23, 2026 |
| Colonial Van Lines colonialvanlines.com | Not identified | United States | Feb 23, 2026 |
Showing the 20 most recent of 540. Browse recent data breaches for more.
Medusa leak sites
Addresses we've seen Medusa publish victims from. Any .onion address needs the Tor Browser.
xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onionmedusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onioncx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd.onions7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onionz6wkgghtoawog5noty5nxulmmt2zs7c3yvwr22v4czbffdoly2kl4uad.onionalphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion7aqabivkwmpvjkyefonf3gpy5gsubopqni7kcirsrq3pflckxq5zz4id.onionwtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionlockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onionqkzxzeabulbbaevqkoy2ew4nukakbi4etnnkcyo3avhwu7ih7cql4gyd.onion
Medusa questions
Is Medusa still active?
It's gone quiet. The last victim we recorded was May 11, 2026, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has Medusa claimed?
Medusa has named 540 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 69 of them were posted in the last 12 months.
When did Medusa first appear?
The first victim we recorded for Medusa was posted on February 14, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Medusa target?
Manufacturing accounts for the most victims we can classify, with 52. Healthcare follows at 47. We could identify a sector for 315 of 540 victims, so treat this as the shape of the targeting rather than a full census.
Has Medusa already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.