ARDEX Australia Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized firms across manufacturing and construction-related sectors, using double-extortion tactics that combine system encryption with data theft and public leak-site pressure. Against that backdrop, ARDEX Australia was listed by the Medusa ransomware group on 29 January 2025. Public reporting indicates the group claims to have exfiltrated internal files during a ransomware attack; the number of people affected remains unknown and further operational details have not been released.

The listing itself is a claim made by the threat actor. Independent confirmation of the full scope, the precise intrusion method, or the volume of material taken has not been published. For employees, partners and customers of a specialist building-products company, the episode underscores how quickly operational data can become a leverage point even when the exact contents stay undisclosed.

What happened

According to the available record, ARDEX Australia appeared on Medusa’s leak site on 29 January 2025. The group asserts that it carried out a ransomware attack in which internal files were exfiltrated. No public statement has confirmed the date of initial access, the attack vector, the duration of the intrusion, or whether systems were encrypted in addition to the claimed data theft. The number of individuals whose information may be involved is listed as unknown. Beyond the headline claim of internal-file exfiltration, the record contains no further technical or quantitative detail.

The group behind it: medusa

Medusa is a ransomware-as-a-service operation that has been active for several years and is documented for its double-extortion model. Typical activity involves gaining access to corporate networks, stealing data, deploying encryptors, and then publishing victim names on a dedicated leak site if a ransom is not paid. The group has previously listed organisations across manufacturing, professional services and industrial sectors, often releasing sample files to demonstrate possession. In this instance the listing of ARDEX Australia is presented solely as Medusa’s claim; no independent verification of the stolen material’s authenticity or completeness has been supplied in the public record.

Who is ARDEX Australia?

ARDEX Australia supplies engineering products and systems used in construction and building finishes. Its catalogue covers floor-alignment and adhesive solutions, tile and natural-stone systems, liquid waterproofing membranes, and decorative surface materials. The company’s corporate office is located at 20 Powers Road, Seven Hills, New South Wales 2147, and it employs approximately 139 people. Firms of this type routinely maintain commercial contracts, technical specifications, supplier records, employee information and customer project data. A breach affecting such an organisation can therefore touch both internal operations and external business relationships in the Australian building-products supply chain.

The information in question

The only data category named in the public record is “internal files” said to have been exfiltrated. No inventory of file types, no count of records, and no confirmation of personal identifiers, financial details or customer lists have been released. Organisations operating in the construction-materials sector commonly hold employee personnel files, payroll data, supplier contracts, product formulations, project documentation and customer contact information. Because the exact contents remain unconfirmed, it is not possible to state which of these categories, if any, are present in the material Medusa claims to possess.

Why it matters

For individuals whose details may appear in the claimed files, the practical risks include potential misuse of contact or employment information for phishing, social-engineering attempts or identity fraud. For ARDEX Australia the consequences can include operational disruption, contractual obligations to notify partners, regulatory scrutiny under Australian privacy rules, and reputational pressure arising from the public listing itself. Even when the precise data set is unknown, the mere assertion of exfiltration creates uncertainty that affected parties must manage. Mid-sized industrial firms often lack the same security resources as large multinationals, making them frequent targets and amplifying the impact of any successful intrusion.

Were you affected?

If you are a current or former employee, contractor, supplier or customer of ARDEX Australia, treat the listing as a prompt to review your own exposure. Monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and be alert to unsolicited messages that reference the company or its products. Change passwords that may have been reused across work and personal services. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official notifications, if any are issued by the company or regulators, will provide the most authoritative guidance on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.