Medusa Ransomware Hits Compass Group Australia in Major Cyberattack
Incident Date:
September 18, 2024
Overview
Title
Medusa Ransomware Hits Compass Group Australia in Major Cyberattack
Victim
Compass Group
Attacker
Medusa
Location
First Reported
September 18, 2024
Medusa Ransomware Group Targets Compass Group Australia
Compass Group Australia, a leading food and support services company, has fallen victim to a ransomware attack orchestrated by the Medusa ransomware group. The attackers claim to have accessed 785.5 GB of organizational data, significantly impacting the company's operations.
About Compass Group Australia
Compass Group Australia is a subsidiary of Compass Group PLC, a British multinational company specializing in contract food services and support services. With a workforce of approximately 13,000 team members, Compass Group Australia serves a diverse clientele, including hospitals, schools, universities, corporate offices, and major entertainment venues. The company is known for its commitment to health, sustainability, and community engagement, generating over $1 billion in annual revenue.
Attack Overview
The Medusa ransomware group announced the attack on Compass Group Australia via their dark web leak site. The attackers criticized the company's network security, mocking the efforts of network administrators who had installed Crowdstrike Falcon EDR. They also claimed to have taken screenshots of the domain controller, further highlighting the breach. A spokesperson for Compass Group confirmed the cyber incident, stating that it has impacted some of their systems and that they are collaborating with cybersecurity experts to investigate and restore their systems.
About Medusa Ransomware Group
Medusa is a ransomware group that emerged in late 2022 and operates as a Ransomware-as-a-Service (RaaS) platform. The group has been involved in various high-profile attacks targeting multiple sectors globally, including education, healthcare, and government services. Medusa's ransomware is designed to kill numerous applications and services to prevent detection and mitigation, and it disables shadow copies to thwart recovery efforts. The group often releases stolen data publicly if ransoms are not paid, further pressuring victims to comply.
Vulnerabilities and Penetration
Compass Group Australia's extensive operations and large workforce make it a lucrative target for ransomware groups like Medusa. Despite implementing security measures such as Crowdstrike Falcon EDR, the attackers were able to penetrate the company's systems, likely exploiting vulnerabilities in network security protocols or through phishing attacks. The breach underscores the importance of continuous monitoring and advanced cybersecurity measures to protect against sophisticated ransomware threats.
Sources:
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.