Loading story…
The Medusa ransomware group publicly claimed responsibility for a significant cyberattack against Comcast Corporation, one of the world's largest media and technology companies. According to statements posted on Medusa's dark web leak site, the attackers exfiltrated approximately 834.4 gigabytes of internal data from Comcast. The group demanded a ransom of $1.2 million, offering the data for sale to interested buyers or, alternatively, to Comcast itself for deletion. To substantiate their claims, Medusa published around 20 screenshots allegedly depicting internal Comcast files, as well as a comprehensive file listing containing 167,121 entries. The exposed files reportedly include actuarial reports, product management data, insurance modeling scripts, claim analytics, and various Python and SQL scripts related to auto premium impact analysis. The attack was first publicized on September 26, 2025, and further detailed on September 28, 2025, through Medusa's leak site. While Comcast has not officially confirmed the breach, the scale and specificity of the data samples have raised significant concerns within the cybersecurity community. Medusa is known for its double extortion tactics, combining data encryption with exfiltration and public shaming to pressure victims. The group has a history of targeting large organizations and auctioning stolen data to third parties, increasing the risk of exposure for affected entities. The potential operational, regulatory, and reputational impacts for Comcast are substantial, particularly if sensitive partner or customer data is included in the breach. Industry observers note that this incident underscores the evolving threat landscape of ransomware in 2025, where attackers leverage both technical and psychological pressure. The breach has prompted renewed calls for rigorous defense-in-depth strategies and mature incident response protocols among large enterprises. Data protection regulations may subject Comcast to heightened scrutiny if the breach is verified and sensitive information is confirmed. The incident also highlights the importance of monitoring dark web leak sites and threat intelligence sources for early detection of such claims. Medusa's approach in this case mirrors its broader campaign of aggressive extortion and public exposure. The attack serves as a stark reminder of the persistent and adaptive nature of ransomware threats facing critical infrastructure and major corporations. Security teams are advised to review their incident response and data protection measures in light of this high-profile breach. The full extent of the data compromised and the potential downstream effects remain under investigation. The Medusa-Comcast incident is likely to influence both industry best practices and regulatory expectations in the near future.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Multiple reports said the Medusa ransomware group listed Comcast as a victim and claimed to have stolen a large volume of company data. The gang reportedly demanded a $1.2 million payment in connection with the alleged breach.
3 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcescworld.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Medusa ransomware group published 186.36 GB of compressed data, totaling approximately 834 GB when decompressed, allegedly stolen from Comcast Corporation after the company refused to pay a $1.2 million ransom. The leaked data, made available in 47 split files on Medusa's dark web site, reportedly includes sensitive information such as Excel files with claim data specifications and Python and SQL scripts related to auto premium impact analysis. Comcast has not publicly acknowledged or responded to the breach or the data leak. The incident follows Medusa's pattern of targeting major organizations and leaking data when ransom demands are unmet, as seen in a previous attack on NASCAR. Security researchers and Microsoft have noted that Medusa has recently exploited the critical GoAnywhere MFT vulnerability (CVE-2025-10035) to facilitate unauthenticated remote code execution in its attacks. The exposure of such a large volume of potentially sensitive data poses significant risks to Comcast and its stakeholders, underscoring the ongoing threat posed by ransomware groups leveraging high-impact vulnerabilities.
Jun 29, 2026
SimonMed Imaging, one of the largest outpatient medical imaging providers in the United States, experienced a significant data breach following a ransomware attack by the Medusa group. The incident resulted in unauthorized access to SimonMed’s systems between January 21 and February 5, 2025, as confirmed by both company statements and regulatory filings. The breach was initially discovered on January 27, 2025, after a vendor notified SimonMed of a security incident, prompting an immediate internal investigation. The attackers reportedly stole approximately 200 GB of data, impacting over 1.2 million individuals whose sensitive information was exposed. SimonMed Imaging provides a wide range of diagnostic services, including MRI, CT, X-ray, ultrasound, mammography, PET, nuclear medicine, bone density, and interventional radiology, and operates around 170 medical centers across 11 states. The compromised data includes names, addresses, birth dates, dates of service, and provider names, with the potential for even more sensitive medical information to have been accessed, given the nature of the business. In response to the breach, SimonMed took several remediation steps, such as resetting passwords, strengthening multi-factor authentication, implementing enhanced endpoint detection and response monitoring, removing direct vendor access, and restricting network traffic to trusted connections. The company also engaged data security and privacy professionals and notified law enforcement authorities. As of October 10, 2025, SimonMed stated there was no evidence that the stolen information had been misused for identity theft or fraud. The company emphasized that the investigation is ongoing to determine the full scope of the data affected. The breach highlights the persistent threat of ransomware attacks targeting healthcare organizations, which often store large volumes of sensitive patient data. SimonMed’s swift response included notifying affected individuals and regulatory bodies, as required by law. The Medusa ransomware group’s involvement underscores the increasing sophistication and impact of cybercriminal operations against critical healthcare infrastructure. The incident has raised concerns about third-party vendor security, as the initial alert came from an external partner experiencing its own security issues. SimonMed’s annual revenue exceeds $500 million, and the scale of this breach is among the largest in the healthcare sector for 2025. The company continues to monitor for any signs of misuse of the compromised data and is providing support to affected individuals. This event serves as a stark reminder of the importance of robust cybersecurity measures and incident response planning in the healthcare industry.
Jun 29, 2026
**University of Mississippi Medical Center (UMMC)** is facing an extortion threat after the **Medusa** ransomware gang claimed responsibility for the February cyberattack that disrupted hospital operations and forced staff to rely on paper processes and other offline workarounds. The incident affected one of Mississippi’s most critical healthcare providers, with hospitals and emergency departments remaining open while **35 clinic locations** were closed; recovery involved assistance from the **FBI** and **Department of Homeland Security**, and full reopening was reported on March 2. Medusa later posted on its leak site that it had stolen data from UMMC and demanded **$800,000**, with a deadline of **March 20**. Reporting indicates the gang offered multiple extortion options, including paying to delete the data, buying the allegedly stolen information, or paying a smaller amount to extend the deadline. Screenshots were published as purported proof of theft, but UMMC had not confirmed that sensitive patient or enterprise data was actually exfiltrated, and the size and scope of the alleged data set remained unclear at the time of reporting.
Jun 29, 2026