Medusa Ransomware Hits Compass Group Australia in Major Cyberattack
Medusa Ransomware Group Targets Compass Group Australia
Compass Group Australia, a leading food and support services company, has fallen victim to a ransomware attack orchestrated by the Medusa ransomware group. The attackers claim to have accessed 785.5 GB of organizational data, significantly impacting the company's operations.
About Compass Group Australia
Compass Group Australia is a subsidiary of Compass Group PLC, a British multinational company specializing in contract food services and support services. With a workforce of approximately 13,000 team members, Compass Group Australia serves a diverse clientele, including hospitals, schools, universities, corporate offices, and major entertainment venues. The company is known for its commitment to health, sustainability, and community engagement, generating over $1 billion in annual revenue.
Attack Overview
The Medusa ransomware group announced the attack on Compass Group Australia via their dark web leak site. The attackers criticized the company's network security, mocking the efforts of network administrators who had installed Crowdstrike Falcon EDR. They also claimed to have taken screenshots of the domain controller, further highlighting the breach. A spokesperson for Compass Group confirmed the cyber incident, stating that it has impacted some of their systems and that they are collaborating with cybersecurity experts to investigate and restore their systems.
About Medusa Ransomware Group
Medusa is a ransomware group that emerged in late 2022 and operates as a Ransomware-as-a-Service (RaaS) platform. The group has been involved in various high-profile attacks targeting multiple sectors globally, including education, healthcare, and government services. Medusa's ransomware is designed to kill numerous applications and services to prevent detection and mitigation, and it disables shadow copies to thwart recovery efforts. The group often releases stolen data publicly if ransoms are not paid, further pressuring victims to comply.
Vulnerabilities and Penetration
Compass Group Australia's extensive operations and large workforce make it a lucrative target for ransomware groups like Medusa. Despite implementing security measures such as Crowdstrike Falcon EDR, the attackers were able to penetrate the company's systems, likely exploiting vulnerabilities in network security protocols or through phishing attacks. The breach underscores the importance of continuous monitoring and advanced cybersecurity measures to protect against sophisticated ransomware threats.
Sources:
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!