The Medusa ransomware gang targeted Minneapolis Public Schools, compromising sensitive student data and affecting over 100,000 individuals. This security breach resulted in the exposure of a substantial amount of personal information, leading to heightened concern amongst students, parents, and staff. The incident highlights the vulnerability of educational institutions to cyber attacks and the potential for significant disruption and long-term reputational damage.

Medusa Ransomware Surges, Impacting Over 300 U.S. Critical Infrastructure Organizations A joint advisory from CISA, the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) revealed that the Medusa ransomware operation has compromised over 300 organizations across critical U.S. infrastructure sectors as of February 2025. Targeted industries include medical, education, legal, insurance, technology, and manufacturing. First detected in January 2021, Medusa initially operated as a closed ransomware variant before transitioning into a Ransomware-as-a-Service (RaaS) model in 2023. The group now recruits affiliates—including initial access brokers (IABs)—offering payments ranging from $100 to $1 million for exclusive partnerships. Medusa’s developers maintain control over core operations, including ransom negotiations. To pressure victims, the group launched the Medusa Blog leak site in 2023, using stolen data as leverage. High-profile attacks include breaches of Minneapolis Public Schools (March 2023) and Toyota Financial Services (November 2023), where the gang leaked files after an $8 million ransom demand was refused. Recent data from Symantec’s Threat Hunter Team indicates a 42% increase in Medusa attacks between 2023 and 2024, with nearly double the activity in early 2025 compared to the same period last year. The advisory also clarifies that Medusa is distinct from other similarly named threats, such as MedusaLocker and the Medusa botnet. Defensive recommendations from the agencies include patching vulnerabilities, network segmentation, and blocking untrusted remote access to mitigate risks. The alert follows a separate CISA-FBI warning last month about Ghost ransomware targeting victims across 70 countries.

In February 2023, Minneapolis Public Schools fell victim to a ransomware attack by the Medusa gang, which encrypted district files and exfiltrated highly sensitive data—including student records on sexual misconduct, child abuse inquiries, mental health crises, and suspension reports, as well as educator financial data. The attackers initially demanded $4.5 million in bitcoin, later reducing it to $1 million before leaking the data publicly when the district refused to pay. The breach exposed 105,617 individuals, with victims experiencing financial fraud (e.g., $26,000 stolen from an educator’s account) and direct threats from the hackers via social media. The district delayed notifying affected parties for seven months, citing investigative integrity, while hiring high-cost cybersecurity lawyers ($370/hour) and forensic firms to manage the crisis. The attack disrupted operations, compromised trust, and revealed systemic failures in transparency, with officials initially downplaying the incident as an 'encryption event' despite FBI reports confirming data theft.