# Forces hit by Medusa Locker ransomware

Published: 2026-07-07 · Severity: elevated
Canonical: https://vorant.io/reports/6a78dc33-c8e5-5b21-b51c-7df59c0324da/forces-hit-by-medusa-locker-ransomware

> Medusa Locker ransomware operators claim compromise of Forces with 886 compromised users and 32 employees affected.

Ransomware.live reports a victim listing for Forces allegedly compromised by Medusa Locker ransomware operators. The claim indicates 886 compromised users and 32 compromised employees across the organization, with 251 third-party employee credentials also exposed. The external attack surface assessment identified 60 DNS records associated with the victim's domain. This listing represents post-compromise disclosure typical of ransomware-as-a-service operations that publicly announce victims to pressure payment or establish notoriety. The article itself contains no technical details of attack methodology, exploitation, or malware specifics—it indexes only the public posting by the threat actors.

## Mentioned in this report

- Threat actors: medusalocker
- Malware: MedusaLocker

Source reporting: https://www.ransomware.live/id/Rm9yY2VzQG1lZHVzYWxvY2tlcg==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6a78dc33-c8e5-5b21-b51c-7df59c0324da/forces-hit-by-medusa-locker-ransomware.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup