Berman Brothers Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Berman Brothers, a family-owned scrap metal recycling and fabrication business based in Jacksonville, Florida, has been listed by the medusa ransomware group as a victim of a cyber attack. The listing was reported on January 24, 2025. Public information confirms that internal files were allegedly exfiltrated during a ransomware incident, though the number of people affected remains unknown and further details about the scale or method of the intrusion have not been disclosed.

For a company of this size and type, any confirmed or claimed compromise of internal systems raises practical concerns for employees, business partners, and anyone whose information may have been stored in company files. The listing itself is a claim by the threat actor and has not been independently verified in the available record.

What happened

According to the reported information, Berman Brothers was listed by the medusa ransomware group on or around January 24, 2025. The available facts state that internal files were exfiltrated as part of a ransomware attack. No public confirmation has been provided regarding the exact date the intrusion began, how the attackers gained access, whether systems were encrypted, or whether a ransom demand was issued or paid. The number of people affected is listed as unknown. Beyond the fact of the leak-site listing and the description of internal files being taken, no additional technical or operational details have been released in the public record.

Ransomware incidents of this kind typically involve unauthorized access followed by data theft and, in many cases, encryption of systems. In this instance, the only concrete claim available is that internal files were removed from the company’s environment. Timing, volume of data, and any subsequent publication of those files remain undisclosed.

Inside medusa

Medusa is a ransomware operation that has been active for several years and is known for a double-extortion model. The group typically gains access to a victim’s network, exfiltrates data, encrypts systems, and then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. Listings on that site serve as both pressure and advertising for the group’s activities. Medusa has previously targeted organizations across multiple sectors, including manufacturing, professional services, and smaller commercial businesses, often focusing on entities that may lack extensive cybersecurity resources.

The group’s public claims about any specific victim should be treated as unverified assertions until corroborated by the organization itself or by independent investigation. In the case of Berman Brothers, the listing constitutes such a claim: medusa asserts that it has taken internal files. No further statements attributed to the group about this particular incident appear in the available facts, and no confirmation from Berman Brothers regarding the accuracy of the listing has been reported.

Who is Berman Brothers?

Berman Brothers is described as a family-owned and operated scrap metal recycling facility that also handles metal sales and custom metal fabrication. Its corporate office is located at 2500 Evergreen Ave, Jacksonville, Florida, 32206, United States, and the company employs 81 people. Businesses of this type routinely manage operational records, customer and supplier information, financial documents, employee data, and details related to inventory, shipping, and fabrication projects.

A ransomware incident at a mid-sized industrial or recycling firm can disrupt day-to-day operations, affect supply-chain relationships, and expose records that are not intended for public view. Because such companies often sit at the intersection of physical logistics and commercial transactions, the confidentiality of their internal files matters both for competitive reasons and for the privacy of individuals connected to the business.

What data was at risk

The facts state that internal files were exfiltrated in the ransomware attack. No more granular inventory of those files has been disclosed. Organizations in the scrap-metal recycling, metal sales, and custom fabrication sector typically hold a range of records that can include employee personal information, payroll and benefits data, customer and vendor contact details, contracts, invoices, shipping manifests, and operational or financial documents. Whether any of those specific categories were among the files allegedly taken from Berman Brothers is unconfirmed.

Because the exact contents remain undisclosed, it is not possible to state with certainty what types of personal or commercial data, if any, were exposed. The only confirmed description is the general category of internal files.

The real-world impact

For individuals whose information may have been stored in company systems, the primary risks associated with exfiltrated internal files include potential identity theft, phishing attempts that reference real business relationships, and unauthorized use of personal or financial details. Employees and contractors are often among those most directly affected when internal records leave an organization without authorization. Business partners and customers may also face secondary risks if their contact information or transaction history appears in the stolen material.

For Berman Brothers itself, the incident can create operational disruption, legal and regulatory obligations, and reputational pressure. Even when the precise scope of data loss is unknown, the mere claim of a successful ransomware attack can require notification processes, forensic review, and remediation of systems. The absence of a confirmed count of affected individuals does not eliminate these practical consequences; it simply means the full picture is not yet public.

Were you affected?

If you are a current or former employee, contractor, customer, or supplier of Berman Brothers, treat the reported listing as a reason to remain alert rather than as proof that your personal data has been published. Monitor financial accounts and credit reports for unusual activity, be cautious of unexpected emails or calls that reference the company, and consider placing a fraud alert with the major credit bureaus if you have reason to believe sensitive personal information was held by the firm. Change passwords on any accounts that may have used the same credentials as work-related systems, and enable multi-factor authentication wherever it is available.

Readers who want an additional check can run a free exposure scan of their email address to see whether that address has already appeared in known breach data sets. Such scans do not confirm or rule out involvement in this specific incident, but they can help identify whether an address has previously been exposed elsewhere. Continue to watch for any official statements from Berman Brothers that may provide further clarity on the scope of the event and any recommended next steps for those potentially affected.

AICompiled with AI assistance from public sources and published under our editorial standards.