Medusa Ransomware Hits Construction Systems Inc. in Major Breach
Medusa Ransomware Group Targets Construction Systems Inc. in Significant Data Breach
Construction Systems Inc. (CSi), a prominent contractor specializing in interior renovations and tenant fit-outs in central Ohio, has fallen victim to a ransomware attack orchestrated by the Medusa group. The attack, discovered on October 14, involves the exfiltration of 80.80 GB of sensitive data, with a ransom demand of $100,000 set by the attackers.
Company Profile and Industry Standing
CSi, an employee-owned company based in Columbus, Ohio, has been a key player in the construction industry for over 50 years. With a workforce of 51 to 200 employees, the company generates an estimated annual revenue between $5 million to $10 million. CSi is renowned for its expertise in interior renovations and fit-outs, particularly in healthcare, education, and commercial sectors. Their self-performance capability, which involves executing projects with in-house skilled craftsmen, sets them apart in the industry, ensuring high-quality control and flexibility.
Details of the Ransomware Attack
The Medusa ransomware group claims to have accessed and exfiltrated a wide array of sensitive information from CSi, including employee personal data, project details, invoices, and financial records. The group has threatened to publish the stolen data if their ransom demand is not met by October 22. Sample screenshots of the compromised data have already been shared on Medusa's dark web portal, underscoring the severity of the breach.
Medusa Ransomware Group: A Notorious Threat
Emerging in late 2022, the Medusa ransomware group has quickly gained notoriety for its aggressive tactics and high-profile attacks across various sectors. Operating as a Ransomware-as-a-Service (RaaS) platform, Medusa enables affiliates to launch attacks using its sophisticated ransomware. The group is known for disabling shadow copies and killing applications to prevent detection and recovery, demanding substantial ransoms for decryption keys.
Potential Vulnerabilities and Attack Penetration
CSi's focus on sensitive and occupied work environments, such as healthcare and education, may have made it an attractive target for Medusa. The company's reliance on digital systems for project management and client interactions could have provided entry points for the ransomware. The attack highlights the growing threat of ransomware to medium-sized enterprises, particularly those with significant data assets and operational dependencies on digital infrastructure.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!