Medusa Ransomware Hits ValeCard: 107GB Data Compromised in Cyber Attack
Medusa Ransomware Group Targets ValeCard in Major Cyber Attack
Overview of ValeCard
ValeCard, established in 1995 and based in Uberlândia, Minas Gerais, Brazil, is a prominent player in the business services sector. Specializing in integrated solutions for business management, the company focuses on employee benefits and fleet management. ValeCard's offerings include meal vouchers, fuel vouchers, and pharmacy benefits, all designed to enhance employee well-being and streamline corporate expenses. The company employs between 501 and 1,000 people and has built a robust platform that centralizes various services, optimizing costs and improving performance for businesses.
Details of the Ransomware Attack
On July 12, 2024, ValeCard reported a ransomware attack by the Medusa ransomware group. The attackers claimed to have compromised at least 107 GB of ValeCard's data and demanded a ransom of $500,000, with an additional $10,000 required for each extra day of negotiation. The stolen data allegedly includes sensitive information such as employee records, balance sheets, bank statements, invoices, document images, WhatsApp screenshots, and other miscellaneous files. Despite social media posts suggesting that up to 1TB of data might have been compromised, ValeCard's operations have reportedly remained unaffected. The company has notified the relevant authorities and is collaborating with cybersecurity experts to investigate the breach and assess its impact.
Profile of the Medusa Ransomware Group
Medusa is a ransomware group that emerged in late 2022 and operates as a Ransomware-as-a-Service (RaaS) platform. The group has been involved in various high-profile attacks targeting multiple sectors globally, including education, healthcare, and government services. Medusa's ransomware is designed to kill numerous applications and services to prevent detection and mitigation, and it disables shadow copies to thwart recovery efforts. The group often releases stolen data publicly if ransoms are not paid, further pressuring victims to comply.
Potential Vulnerabilities and Penetration Methods
ValeCard's focus on technology and innovation, while a strength, may also present vulnerabilities that threat actors like Medusa can exploit. The company's extensive use of digital platforms and centralized services could have been targeted through phishing attacks, exploiting software vulnerabilities, or leveraging weak security protocols. The exact method of penetration remains under investigation, but the attack underscores the importance of robust cybersecurity measures in protecting sensitive corporate data.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!