Medusa Ransomware Hits ValeCard: 107GB Data Compromised in Cyber Attack
Incident Date:
July 23, 2024
Overview
Title
Medusa Ransomware Hits ValeCard: 107GB Data Compromised in Cyber Attack
Victim
ValeCard
Attacker
Medusa
Location
First Reported
July 23, 2024
Medusa Ransomware Group Targets ValeCard in Major Cyber Attack
Overview of ValeCard
ValeCard, established in 1995 and based in Uberlândia, Minas Gerais, Brazil, is a prominent player in the business services sector. Specializing in integrated solutions for business management, the company focuses on employee benefits and fleet management. ValeCard's offerings include meal vouchers, fuel vouchers, and pharmacy benefits, all designed to enhance employee well-being and streamline corporate expenses. The company employs between 501 and 1,000 people and has built a robust platform that centralizes various services, optimizing costs and improving performance for businesses.
Details of the Ransomware Attack
On July 12, 2024, ValeCard reported a ransomware attack by the Medusa ransomware group. The attackers claimed to have compromised at least 107 GB of ValeCard's data and demanded a ransom of $500,000, with an additional $10,000 required for each extra day of negotiation. The stolen data allegedly includes sensitive information such as employee records, balance sheets, bank statements, invoices, document images, WhatsApp screenshots, and other miscellaneous files. Despite social media posts suggesting that up to 1TB of data might have been compromised, ValeCard's operations have reportedly remained unaffected. The company has notified the relevant authorities and is collaborating with cybersecurity experts to investigate the breach and assess its impact.
Profile of the Medusa Ransomware Group
Medusa is a ransomware group that emerged in late 2022 and operates as a Ransomware-as-a-Service (RaaS) platform. The group has been involved in various high-profile attacks targeting multiple sectors globally, including education, healthcare, and government services. Medusa's ransomware is designed to kill numerous applications and services to prevent detection and mitigation, and it disables shadow copies to thwart recovery efforts. The group often releases stolen data publicly if ransoms are not paid, further pressuring victims to comply.
Potential Vulnerabilities and Penetration Methods
ValeCard's focus on technology and innovation, while a strength, may also present vulnerabilities that threat actors like Medusa can exploit. The company's extensive use of digital platforms and centralized services could have been targeted through phishing attacks, exploiting software vulnerabilities, or leveraging weak security protocols. The exact method of penetration remains under investigation, but the attack underscores the importance of robust cybersecurity measures in protecting sensitive corporate data.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.