CISA Says Medusa Ransomware Affected More Than 500 Critical Infrastructure Organizations

Aug 19, 2026 · Original article ↗

Summary

CISA, HHS, and the FBI reported that Medusa ransomware affected more than 500 U.S. critical infrastructure organizations since June 2021. They recommend patching vulnerabilities, segmenting networks, and restricting untrusted access to internal remote services.

Key points

CISA, HHS, and the FBI said Medusa had impacted more than 500 U.S. critical infrastructure organizations as of April 2026.
Affected sectors include healthcare, defense, manufacturing, government, IT, and financial services.
The agencies updated a March 2025 report that estimated Medusa had affected more than 300 critical infrastructure organizations.
The agencies advise patching vulnerabilities, segmenting networks to limit lateral movement, and restricting untrusted access to internal remote services.
Medusa activity increased in 2023 after the operation launched a leak site and used stolen data for extortion.
The advisory says Medusa recruits initial access brokers and offers affiliates payments ranging from $100 to $1 million.

Article Details

Event Type: Joint government advisory on Medusa ransomware activity.
Impact: CISA, HHS, and the FBI reported that Medusa actors had impacted more than 500 U.S. critical infrastructure organizations since June 2021, across sectors including healthcare, defense, manufacturing, government, IT, and financial services. The operation uses stolen data to pressure victims into paying ransoms.

Threat Actors

MedusaThe article identifies Medusa as a ransomware cybercrime operation that reportedly impacted more than 500 U.S. critical infrastructure organizations and uses stolen data for extortion. It distinguishes this operation from MedusaLocker and other entities also named Medusa.

Countries

United StatesMedusa has breached more than 500 critical infrastructure organizations in the United States.

Industries

critical manufacturingcritical infrastructure sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services,” they said.Defense industrial baseAffected sectors include healthcare, defense industrial base, manufacturing, government, IT, and financial services.Education“Other victims include organizations in the medical, education, legal, insurance, technology, and manufacturing industries.”Financial Servicescritical infrastructure organizations since June 2021, affecting sectors such as healthcare, defense, manufacturing, government, IT, and financial services.Government Services and Facilitiesincluding Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services,” they said.Healthcarecritical infrastructure organizations since June 2021, affecting sectors such as healthcare, defense, manufacturing, government, IT, and financial services.Information TechnologyHealth, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services,” they said.Insurance“Other victims include organizations in the medical, education, legal, insurance, technology, and manufacturing industries.”Legal“Other victims include organizations in the medical, education, legal, insurance, technology, and manufacturing industries.”