CISA: Medusa ransomware hit over 500 critical infrastructure orgs
Medusa ransomware has impacted over 500 critical infrastructure organizations in the US since June 2021.
The Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021, according to a joint advisory from CISA, HHS, and the FBI. The advisory updates a previous report from March 2025, which indicated over 300 victims. Medusa operates as a Ransomware-as-a-Service (RaaS) and has been active since January 2021, escalating its activity in 2023 by using stolen data for ransom leverage.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe Medusa ransomware gang has compromised over 500 critical infrastructure organizations by exploiting unpatched vulnerabilities and leveraging stolen credentials, operating as a Ransomware-as-a-Service (RaaS) model that lowers the barrier for attackers. The escalating victim count — from 300 to 500+ in just months — signals that affected sectors are failing to implement adequate defensive controls in time. Medusa's use of stolen data as additional ransom leverage (double extortion) amplifies the damage beyond operational disruption to include serious data breach exposure. Critical infrastructure organizations face heightened responsibility because disruptions can cascade into public safety risks, making resilience and rapid response not just best practice but a societal imperative.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.