Medusa Ransomware Strikes R.H. Clarkson Insurance Group
Medusa Ransomware Group Targets R.H. Clarkson Insurance Group
R.H. Clarkson Insurance Group, a prominent independent insurance broker based in Louisville, Kentucky, has fallen victim to a ransomware attack orchestrated by the Medusa ransomware group. This attack, identified on December 14, 2024, has resulted in the exfiltration of approximately 115.9 GB of sensitive data, with the threat actors threatening to release the data publicly within 15 to 16 days.
Company Profile and Industry Standing
Founded in 1964 by Bobby Clarkson, R.H. Clarkson Insurance Group has grown from a small operation to a significant player in the insurance industry, operating across all 50 states. The company specializes in a wide range of insurance products, including life, health, disability, commercial insurance, and retirement services. With a team of approximately 33 employees, the agency is known for its personalized service and commitment to finding tailored insurance solutions for its clients. This focus on customer service and competitive pricing has earned R.H. Clarkson a strong reputation as a trusted insurance partner.
Vulnerabilities and Attack Overview
The Medusa ransomware group, known for its sophisticated Ransomware-as-a-Service model, has exploited vulnerabilities in R.H. Clarkson's systems to gain unauthorized access. The group's typical attack vectors include phishing emails and exploiting software vulnerabilities, which may have been the entry points in this case. The attack underscores the challenges faced by companies in the insurance sector, which often handle large volumes of sensitive data, making them attractive targets for cybercriminals.
Medusa Ransomware Group's Tactics
Medusa distinguishes itself through its rapid encryption capabilities and multi-extortion strategies. The group employs a hybrid encryption model using AES-256 and RSA-2048 algorithms, making data recovery without a decryption key nearly impossible. Medusa's operations are characterized by advanced evasion techniques, including disabling antivirus software and using legitimate administrative tools to maintain stealth. The group also operates a dedicated leak site, the Medusa Blog, where they publicize stolen data and negotiate ransom terms.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!