How does Medusa steal data before encrypting it?

Medusa operates through affiliates who exploit exposed systems, such as internet-facing services and unpatched software, to get in. Once inside, they take data first and encrypt second, often while systems still appear to work normally.

Why does the double-extortion model expose ordinary people?

Because data is stolen before encryption, victims face both losing access to systems and having stolen information published or sold. Organizations hold records about customers, patients, employees and students, so the people named in those files are exposed even if they never had a say in security.

Does restoring from backups solve the problem?

Restoring from backups solves the problem of losing access to systems but does nothing about the threat of stolen information being published or sold. Paying or not paying the ransom also does not undo the copying.

How many victims has Medusa hit?

Medusa has now hit more than 500 victims, according to the article. This count shows it is a sustained, repeatable operation and not a one-off campaign.

Medusa Ransomware Data Theft Before Encryption: 500+ Victims

When most people picture a ransomware attack, they imagine locked screens and encrypted files. With Medusa, that picture is incomplete. Reporting on the group, which has now hit more than 500 victims, points to a pattern that matters far more to ordinary people: Medusa ransomware data theft before encryption means the harm can be done before anyone notices a problem.

This post explains how that sequence works, why it exposes individuals as well as organizations, and what you can do about it. It draws on the source article's summary and on our earlier coverage of the group.

How Medusa steals data before it encrypts

Medusa operates through affiliates, and the source article describes them exploiting exposed systems to get in. That means internet-facing services and unpatched software are the typical doorway, not a sophisticated trick aimed at an individual employee.

Once inside, the affiliates take data first and encrypt second. The theft happens quietly, often while systems still appear to work normally. Encryption comes later, and it is the visible event that finally alerts the victim. By then, copies of sensitive files may already be outside the network.

This ordering explains why the source article argues for a prevention-first strategy. If defenders only react once files are locked, the most damaging step has already taken place. Stopping data from leaving the network, and closing exposed entry points, matters more than restoring from backups alone.

Why the double-extortion model exposes ordinary people

Because the data is stolen before encryption, victims face two separate threats. One is losing access to their systems. The other is having stolen information published or sold if they refuse to pay. Restoring from backups solves the first problem but does nothing about the second.

That is where individuals come in. Organizations hold records about customers, patients, employees and students. When an affiliate copies those files, the people named in them are exposed, even though they never had a say in how the organization secured its systems. Paying or not paying the ransom does not undo the copying.

The federal advisory coverage we have published shows how this plays out in sectors that hold sensitive records. Our report on how federal agencies updated their Medusa guidance for healthcare describes how the group operates, including its ransom approach. Healthcare data is especially personal, so a stolen file there can carry long-lasting consequences for the people in it.

What Medusa's 500+ victims reveal about the threat

The headline figure is the scale. Our earlier piece on the 500+ organizations Medusa has breached covers the joint warning from CISA, the FBI and HHS. A count that high shows this is a sustained, repeatable operation and not a one-off campaign.

A few takeaways follow from that scale:

The model works across sectors. Affiliates rely on common weaknesses such as exposed systems, so victims vary widely in size and industry.
Refusing to pay is not a full defense. Swiss manufacturer Stadler Rail rejected a $12.3M Medusa ransom demand, which shows some victims choose not to pay. But declining to pay does not reverse any data theft that already occurred.
Pricing is calculated. As we noted when covering how Medusa ties ransom demands to revenue, the group tailors its demands rather than using a flat fee.

Taken together, the picture is of a group that treats stolen data as leverage, and treats victims as customers to be priced.

Practical steps to reduce your exposure

You cannot patch another organization's servers, but you can limit what a leak would reveal and how far it could spread.

Use unique passwords and a password manager. If a breach exposes credentials, unique passwords stop one leak from unlocking other accounts.
Turn on multi-factor authentication. Prefer app-based or hardware methods over SMS where available.
Share less. Give organizations only the personal details they truly need. Data that was never collected cannot be stolen.
Watch for follow-up fraud. Stolen records often fuel phishing. Treat unexpected messages that reference real personal details with suspicion.
Consider a credit freeze. If sensitive identifiers may be exposed, a freeze makes it harder to open accounts in your name.
Keep your own devices updated. The same discipline that defenders urge on organizations, prompt patching, applies at home.

A VPN can protect your traffic on untrusted networks, but it does not protect data already held on someone else's servers. Treat it as one layer, not a fix for this threat.

What This Means For You

The key lesson is that the ransom note is not the beginning of the harm. By the time it appears, your information may already be copied. That shifts the question from "will the organization pay?" to "what would be exposed if they did not?" Assume that any organization holding your data could be breached, and limit your exposure accordingly.

For people who run or work in small organizations, the source article's prevention-first message applies directly: reduce exposed systems, patch promptly, and watch for data leaving your network, not just for files being locked.

Takeaways and next steps

Medusa ransomware data theft before encryption is the core reason this group's 500+ victim count matters to everyone, not just IT teams. To see how the group operates and what agencies recommend, read our coverage of the 500+ organizations breached and the updated healthcare guidance. Then take ten minutes to review your own accounts: change reused passwords, enable multi-factor authentication, and consider what personal data you could stop sharing.