MedusaLocker
Data as of October 1, 2026.
What industries MedusaLocker targets
Sector identified for 15 of 20 victims.
| Manufacturing | 4 | |
| Education | 2 | |
| Retail | 2 | |
| Government | 2 | |
| Construction | 1 | |
| Logistics | 1 | |
| Automotive | 1 | |
| Non-profit | 1 |
Where the victims are located
Country identified for 16 of 20 victims.
| United States | 5 | |
| Brazil | 2 | |
| Australia | 2 | |
| France | 1 | |
| Malaysia | 1 | |
| Israel | 1 | |
| Bulgaria | 1 | |
| Italy | 1 |
Every MedusaLocker victim
| Victim | Sector | Country | Posted |
|---|---|---|---|
| ATCO atco.com | Not identified | Not identified | Sep 29, 2026 |
| Junta de Andalucía juntadeandalucia.es | Not identified | Spain | Sep 29, 2026 |
| Palli Karma-Sahayak Foundation pksf-bd.org | Financial Services | Not identified | Sep 29, 2026 |
| Premium Fruits premiumfruits.eu | Not identified | Not identified | Sep 29, 2026 |
| Académie de Montpellier ac-montpellier.fr | Education | France | May 11, 2026 |
| Atencio Engineering atencioengineering.com | Construction | United States | May 11, 2026 |
| Bandeirante Supermercados bandeirantesupermercados.com.br | Retail | Brazil | May 11, 2026 |
| CEAGESP ceagesp.org | Government | Brazil | May 11, 2026 |
| CourtSmart courtsmart.com | Government | United States | May 11, 2026 |
| Desert Christian Schools desertchristian.com | Education | United States | May 11, 2026 |
| Elken elken.com | Manufacturing | Malaysia | May 11, 2026 |
| Magnolia magnolia.co.il | Retail | Israel | May 11, 2026 |
| Colegio María Inmaculada mariainmaculada.ed.cr | Not identified | Not identified | May 11, 2026 |
| Palmers Relocations palmersrelocations.com.au | Logistics | Australia | May 11, 2026 |
| Rayco Lighting raycolighting.com | Not identified | United States | May 11, 2026 |
| Robusta robusta.bg | Manufacturing | Bulgaria | May 11, 2026 |
| SIT Group sitgroup.it | Manufacturing | Italy | May 11, 2026 |
| Strategic Imports strategicimports.com.au | Automotive | Australia | May 11, 2026 |
| ActionAid Tanzania actionaid.org | Non-profit | United Kingdom | May 11, 2026 |
| Trimble trimble.com | Manufacturing | United States | May 11, 2026 |
Browse recent data breaches for more.
MedusaLocker leak site
The address we've seen MedusaLocker publish victims from. Any .onion address needs the Tor Browser.
t33zoj4qwv455fog7qnb2azi5xcdxkixughmmduzbw2rtdgryqfbh6id.onion
MedusaLocker questions
Is MedusaLocker still active?
Yes. MedusaLocker posted its most recent victim on September 29, 2026. That's 4 victims in the last 30 days.
How many victims has MedusaLocker claimed?
MedusaLocker has named 20 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did MedusaLocker first appear?
The first victim we recorded for MedusaLocker was posted on May 11, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does MedusaLocker target?
Manufacturing accounts for the most victims we can classify, with 4. Education follows at 2. We could identify a sector for 15 of 20 victims, so treat this as the shape of the targeting rather than a full census.
Has MedusaLocker already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.