Medusa Group Blamed for Attack That Encrypted 1,285 Computers at French High School

Summary

A cyberattack in April encrypted teaching files and disrupted 1,285 computers at a Béziers high school. Investigators reportedly identified the Russian group Medusa; no sensitive data was reported stolen, and the school replaced hundreds of computers.

Key points

• The attack was discovered on April 6, when staff found unknown files on school servers and teaching files encrypted; more than 1,280 computers were taken out of use.
• Midi Libre reports that investigators identified the Russian cybercriminal group Medusa, citing a source close to the case.
• The attackers reportedly exploited around 700 aging Windows 7 computers whose security updates had ended in 2023; about 650 were discarded.
• Administrative services and their more sensitive data were not affected, and the article reports that no ransom was demanded.
• More than 380 replacement computers were deployed in about 12 days ahead of some BTS exams; the school said the new school year proceeded almost normally.
• The school spent €100,000 on replacement computers, while the regional authority faced costs of several hundred thousand euros.

People

Threat Actors

Products

Related Articles

• A Playbook for Hardening Remote Access Tools in SMBsMedusa
• Cybersecurity Roundup: Medusa Ransomware, Sandworm Campaign and Major BreachesMedusa
• BYOVD Attacks Turn Signed Vulnerable Drivers into Kernel-Level BackdoorsMedusa
• Ransomware Attacks Often Begin Long Before Encryption, Huntress SaysMedusa
• How the Ransomware-as-a-Service Model Works—and What Defenders Should Watch ForMedusa