Loading story…
The Medusa ransomware group published 186.36 GB of compressed data, totaling approximately 834 GB when decompressed, allegedly stolen from Comcast Corporation after the company refused to pay a $1.2 million ransom. The leaked data, made available in 47 split files on Medusa's dark web site, reportedly includes sensitive information such as Excel files with claim data specifications and Python and SQL scripts related to auto premium impact analysis. Comcast has not publicly acknowledged or responded to the breach or the data leak.
The incident follows Medusa's pattern of targeting major organizations and leaking data when ransom demands are unmet, as seen in a previous attack on NASCAR. Security researchers and Microsoft have noted that Medusa has recently exploited the critical GoAnywhere MFT vulnerability (CVE-2025-10035) to facilitate unauthenticated remote code execution in its attacks. The exposure of such a large volume of potentially sensitive data poses significant risks to Comcast and its stakeholders, underscoring the ongoing threat posed by ransomware groups leveraging high-impact vulnerabilities.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
After the ransom was not paid, Medusa posted Comcast data for download on its leak site. Reports described the exposure as 186.36 GB of compressed files, corresponding to about 834 GB of stolen data across 47 files.
The Medusa ransomware gang allegedly demanded a $1.2 million ransom from Comcast in connection with stolen company data. The later leak was reported as occurring after Comcast refused to pay.
Researchers examined a sample of data attributed to Comcast in late September 2025. The sample reportedly included Excel files on claim data specifications and Python/SQL scripts related to auto premium impact analysis.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Medusa ransomware group publicly claimed responsibility for a significant cyberattack against Comcast Corporation, one of the world's largest media and technology companies. According to statements posted on Medusa's dark web leak site, the attackers exfiltrated approximately 834.4 gigabytes of internal data from Comcast. The group demanded a ransom of $1.2 million, offering the data for sale to interested buyers or, alternatively, to Comcast itself for deletion. To substantiate their claims, Medusa published around 20 screenshots allegedly depicting internal Comcast files, as well as a comprehensive file listing containing 167,121 entries. The exposed files reportedly include actuarial reports, product management data, insurance modeling scripts, claim analytics, and various Python and SQL scripts related to auto premium impact analysis. The attack was first publicized on September 26, 2025, and further detailed on September 28, 2025, through Medusa's leak site. While Comcast has not officially confirmed the breach, the scale and specificity of the data samples have raised significant concerns within the cybersecurity community. Medusa is known for its double extortion tactics, combining data encryption with exfiltration and public shaming to pressure victims. The group has a history of targeting large organizations and auctioning stolen data to third parties, increasing the risk of exposure for affected entities. The potential operational, regulatory, and reputational impacts for Comcast are substantial, particularly if sensitive partner or customer data is included in the breach. Industry observers note that this incident underscores the evolving threat landscape of ransomware in 2025, where attackers leverage both technical and psychological pressure. The breach has prompted renewed calls for rigorous defense-in-depth strategies and mature incident response protocols among large enterprises. Data protection regulations may subject Comcast to heightened scrutiny if the breach is verified and sensitive information is confirmed. The incident also highlights the importance of monitoring dark web leak sites and threat intelligence sources for early detection of such claims. Medusa's approach in this case mirrors its broader campaign of aggressive extortion and public exposure. The attack serves as a stark reminder of the persistent and adaptive nature of ransomware threats facing critical infrastructure and major corporations. Security teams are advised to review their incident response and data protection measures in light of this high-profile breach. The full extent of the data compromised and the potential downstream effects remain under investigation. The Medusa-Comcast incident is likely to influence both industry best practices and regulatory expectations in the near future.
Jun 29, 2026
**University of Mississippi Medical Center (UMMC)** is facing an extortion threat after the **Medusa** ransomware gang claimed responsibility for the February cyberattack that disrupted hospital operations and forced staff to rely on paper processes and other offline workarounds. The incident affected one of Mississippi’s most critical healthcare providers, with hospitals and emergency departments remaining open while **35 clinic locations** were closed; recovery involved assistance from the **FBI** and **Department of Homeland Security**, and full reopening was reported on March 2. Medusa later posted on its leak site that it had stolen data from UMMC and demanded **$800,000**, with a deadline of **March 20**. Reporting indicates the gang offered multiple extortion options, including paying to delete the data, buying the allegedly stolen information, or paying a smaller amount to extend the deadline. Screenshots were published as purported proof of theft, but UMMC had not confirmed that sensitive patient or enterprise data was actually exfiltrated, and the size and scope of the alleged data set remained unclear at the time of reporting.
Jun 29, 2026
CISA, the FBI, and HHS issued an updated joint advisory warning that **Medusa ransomware** operators have compromised more than **500 organizations** as of April 2026, with heavy targeting of **critical infrastructure** and especially **healthcare and public health** entities. The agencies said the group evolved from a closed operation into a **ransomware-as-a-service** model in 2023, using double extortion by stealing data before encrypting systems. Officials said Medusa actors can exploit newly disclosed vulnerabilities within 24 hours, and in some cases were observed abusing flaws up to a week before public disclosure. The advisory said Medusa gains access through **initial access brokers**, reportedly offering up to **$1 million** for exclusive access, and has exploited vulnerabilities including `CVE-2024-1709`, `CVE-2023-48788`, GoAnywhere MFT flaws, and `CVE-2026-1731`. Once inside, operators use living-off-the-land techniques, credential dumping, stolen or vulnerable drivers, and legitimate remote monitoring and management tools to disable security controls, move laterally, steal sensitive data, and encrypt networks. Authorities also described aggressive extortion tactics such as rapid-payment discounts and paid deadline extensions, while urging organizations to patch quickly, segment networks, enforce phishing-resistant MFA, maintain offline immutable backups, and monitor for unauthorized RMM activity.
Aug 20, 2026