Agència Catalana de Notícies (ACN) Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 6 October 2023, the Agència Catalana de Notícies (ACN) was listed by the medusa ransomware group, which claimed to have exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and public detail on the precise scope and method of the incident is limited.

The listing places a long-established Catalan news agency among organisations whose internal material has been claimed by a ransomware operation. What has been confirmed so far is the group’s public claim and the reported nature of the data involved; independent verification of the full extent of any compromise has not been detailed in the available record.

Inside the incident

According to the reported information, Agència Catalana de Notícies (ACN) appeared on medusa’s listings on 6 October 2023. The group asserted that internal files had been exfiltrated in a ransomware attack. No public figure has been given for the volume of data, the number of systems involved, or the exact timeline of any intrusion. The count of people affected is unknown. Technical details of how access was obtained, whether encryption was deployed alongside exfiltration, or whether negotiations took place have not been disclosed in the material available. The incident is therefore known primarily through the threat actor’s claim and the characterisation of the material as internal files taken in a ransomware attack.

Who is medusa?

Medusa is a ransomware group that has operated a leak site on which it names organisations it claims to have compromised and, in many cases, publishes samples or larger sets of stolen data when demands are not met. Like other ransomware operations of this type, it typically combines data theft with the threat of public release, a model often described as double extortion. The group has been associated with attacks across multiple sectors and geographies. Its listings are claims by the actor; they do not by themselves constitute independent confirmation of every detail asserted about a given victim. In this case, the available facts state that ACN was listed and that internal files were described as exfiltrated; no further specific statements by medusa about this victim are recorded in the given material.

About Agència Catalana de Notícies (ACN)

Agència Catalana de Notícies is described as one of the first digital news agencies established in Europe and has been operating since 1999. Its Spanish office is located at Avinguda Josep Tarradellas, 20, 30, 2a planta, 08029 Barcelona. As a news agency, ACN gathers, produces and distributes journalistic content and related operational material. Organisations of this kind routinely hold internal editorial files, correspondence, contact databases, administrative records and systems that support newsgathering and distribution. A breach affecting such an organisation raises concerns not only for staff and partners but also for the integrity and confidentiality of journalistic work and the trust placed in the agency by the public and by media clients.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown of file types, categories of personal data, or specific document sets has been provided. Exact contents therefore remain unconfirmed beyond that description. News agencies typically maintain internal documents, source-related material, employee and contributor information, technical and administrative records, and correspondence. Whether any of those categories were present in the material claimed by medusa is not established in the public record for this incident. Readers should treat the precise composition of the data as undisclosed.

The real-world impact

When internal files from a news organisation are taken, risks can include exposure of staff or contributor personal details, sensitive editorial or source-related information, commercial or contractual material, and credentials or system information that could enable further misuse. For individuals, possible consequences include unwanted contact, phishing that leverages context from the stolen files, or identity-related fraud if personal data were present. For the organisation, consequences can include operational disruption, reputational harm, legal and regulatory obligations, and the need to review access controls and incident response. Because the number of people affected is unknown and the exact data types beyond “internal files” are not detailed, the concrete scale of harm cannot be stated from the available facts. The impact remains a matter of potential risk rather than a fully documented tally of confirmed victims or records.

If your data was in this claimed breach

If you have a connection to Agència Catalana de Notícies—as staff, contributor, partner or contact—consider practical steps while recognising that inclusion in this incident is not confirmed for any individual from the public record alone.

• Monitor accounts and communications for unusual activity or targeted phishing that appears to reference the agency or internal matters.
• Change passwords on work-related and personal accounts if you reused credentials, and enable multi-factor authentication where available.
• Be cautious with unsolicited messages that claim to relate to ACN, medusa, or “your data from the breach.”
• Review financial and identity alerts if you believe personal identifiers may have been held by the organisation.
• You can run a free exposure scan of your email to check whether your information has surfaced in known breach data.

Public detail on this incident remains limited to the October 2023 listing, the claim of internal-file exfiltration, and the background of the organisation. Further clarity would depend on official statements or verified disclosures that have not been included in the facts provided here.

AICompiled with AI assistance from public sources and published under our editorial standards.