AJE Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized manufacturers and consumer-goods firms across Latin America and beyond, using data theft and public leak-site listings as leverage. In this landscape, the appearance of a beverage company on a known extortion site is one more data point in a steady pattern of industrial and commercial intrusions rather than an isolated anomaly.

On 18 June 2024 the organisation AJE was listed by the medusa ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack and that the total volume of data claimed to have been taken is 646.4 GB. The number of people affected remains unknown, and further technical detail about the intrusion has not been disclosed. The listing itself is a claim by the group; independent confirmation of the full scope has not been published in the available record.

What happened

According to the reported summary, AJE was listed by the medusa ransomware group on 18 June 2024. The group asserts that internal files were exfiltrated during a ransomware attack and that the volume of data involved totals 646.4 GB. No public timeline of the intrusion, no description of the initial access method, and no confirmed count of affected individuals have been released. The facts available stop at the leak-site listing and the stated data volume; everything else about timing, scale of personal impact, or technical vectors remains undisclosed.

Who is medusa?

Medusa is a ransomware operation that has been publicly active for several years. Like many contemporary groups, it typically follows a double-extortion model: encrypting systems while also copying data and threatening to publish it on a dedicated leak site if payment is not made. The group posts victim names, sometimes sample files, and claimed data volumes as pressure. Its listings are claims, not independently verified statements of fact. Medusa has previously named organisations across manufacturing, professional services and other sectors; the appearance of any single name on its site should be treated as an unverified assertion until corroborated by the victim or by forensic reporting. Nothing in the present record goes beyond the group’s claim that AJE’s internal files were taken and that 646.4 GB are involved.

About AJE

AJE is a beverage company engaged in the manufacture, distribution and sale of alcoholic and non-alcoholic drinks. It was founded in 1988 and maintains its corporate office at 373 Ave Manuel Olguín, Santiago de Surco, Lima, Peru. Public figures place its workforce at approximately 2,896 employees. Firms of this type routinely hold employee records, supplier and distributor contracts, production and logistics data, financial information and customer or trade-partner details. A breach affecting such an organisation can therefore touch both internal staff and external commercial relationships, even when the precise contents of the stolen material remain unconfirmed.

The information in question

The only data category named in the available facts is “internal files” said to have been exfiltrated in a ransomware attack, with a claimed total volume of 646.4 GB. No further breakdown—such as whether the material includes payroll, human-resources files, customer lists, intellectual property or operational documents—has been disclosed. Organisations in the beverage manufacturing and distribution sector typically retain employee personal data, commercial contracts, inventory and logistics records, and financial documentation. Because the exact contents of the 646.4 GB have not been itemised in public reporting, any statement about specific data types beyond the generic label “internal files” would be speculation. The precise nature of what was taken therefore remains unconfirmed.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include potential misuse of personal or employment-related data for phishing, social engineering or identity-related fraud. For the organisation, exposure of commercial or operational material can create competitive, contractual or regulatory consequences, and the public listing itself can affect reputation and partner confidence. Because the number of people affected is unknown and the exact file types are undisclosed, the concrete scale of harm cannot yet be measured. The situation is therefore one of elevated but still unquantified risk rather than a fully mapped incident.

If your data was in this claimed breach

If you have a past or present connection to AJE—as an employee, contractor, supplier or commercial partner—treat the possibility of exposure seriously even while details remain limited. Practical first steps include:

• Monitor financial and email accounts for unexpected activity or targeted phishing that references the company or its products.
• Change passwords on any accounts that reused credentials associated with work or partner portals, and enable multi-factor authentication where available.
• Be cautious of unsolicited messages that claim to relate to the incident or that request personal or payment information.
• Consider placing fraud alerts with relevant credit or identity-protection services if you believe sensitive personal data may have been involved.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in public or previously reported collections.

Public detail on this incident is limited to the medusa listing, the claimed 646.4 GB of internal files, and the 18 June 2024 reporting date. Further clarity will depend on any statements AJE or independent investigators may later release. Until then, measured vigilance is the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.