Business Software Solutions Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Business Software Solutions, a Utah-based developer of software for small and medium businesses, was listed on March 24, 2025 by the medusa ransomware group. Public reporting states that the group claims to have exfiltrated internal files in a ransomware attack, with a total data volume of 1.00 TB and project source codes described as available. The number of people affected remains unknown, and independent confirmation of the full scope is limited.

For a company that builds and customizes business software, any unauthorized access to internal systems and source code carries practical consequences for the firm, its clients, and anyone whose information may have been stored in those systems. What follows is a factual account of what has been reported so far.

What happened

On March 24, 2025, Business Software Solutions appeared on a listing associated with the medusa ransomware group. According to the reported summary, the incident involved a ransomware attack in which internal files were exfiltrated. The total amount of data leakage is stated as 1.00 TB, and project source codes are described as all available. No further public detail has been provided on the precise method of initial access, the timeline of the intrusion, or whether systems were encrypted in addition to data theft. The number of individuals whose personal or business information may have been involved is unknown. The listing itself constitutes a claim by the group rather than independently verified confirmation of every asserted detail.

Who is medusa?

Medusa is a ransomware operation that has been active in recent years and is known for a double-extortion model. In typical campaigns, the group gains access to a victim network, steals data, and then encrypts systems or files while threatening to publish the stolen material on a dedicated leak site if a ransom is not paid. Medusa has previously listed organizations across multiple sectors, often publishing sample files or larger archives to pressure victims. Public reporting on the group’s activity generally describes opportunistic targeting rather than highly specialized industry focus. In this case, the appearance of Business Software Solutions on the group’s listing is presented as a claim by medusa; the facts available do not include any additional statements the group may have made specifically about this victim beyond the data-volume and source-code assertions already noted.

Who is Business Software Solutions?

Business Software Solutions develops software for small and medium businesses, offering both general-purpose and customized solutions. Its corporate office is located at 334 Marshall Way Ste H, Layton, Utah, 84041, United States, and the company is reported to have 24 employees. Organizations of this type commonly maintain source-code repositories, customer records, internal project documentation, configuration data, and support or billing information related to the businesses they serve. Because the firm supplies tools that other companies rely on for daily operations, a compromise of its internal systems can affect not only its own staff but also the clients who use its products. The limited public footprint of a 24-person firm does not reduce the potential sensitivity of the data it holds; smaller software vendors frequently store credentials, customer contact details, and proprietary code that would be valuable to threat actors.

What data was at risk

The facts name internal files exfiltrated in a ransomware attack, with a reported total leakage of 1.00 TB and project source codes stated as available. Beyond those descriptions, the exact contents of the exfiltrated material have not been itemized in public reporting. Organizations that develop business software typically hold source-code repositories, build artifacts, internal documentation, employee records, and customer-related data such as contact information, licensing details, or support tickets. Whether any of those categories were present in the 1.00 TB volume remains unconfirmed. Because the number of people affected is unknown, it is not possible to state how many individuals’ personal information, if any, may have been included. Readers should treat the precise inventory of exposed data as undisclosed at this time.

Why it matters

For individuals and businesses that have worked with Business Software Solutions, the primary risks are practical rather than abstract. Source code, if published or sold, can reveal proprietary logic, security weaknesses, or integration details that third parties might later exploit. Internal files may contain credentials, configuration data, or correspondence that enable further social-engineering or account-takeover attempts. Clients of a software vendor can face secondary exposure if their own information was stored in the vendor’s systems. For the company itself, the incident can disrupt operations, damage client trust, and create ongoing monitoring and remediation costs. Because the scale of personal data involvement is unknown, affected parties cannot yet assess the full range of identity or financial risks; the absence of a confirmed headcount simply means the picture remains incomplete. Calm, concrete steps—monitoring accounts, reviewing software dependencies, and watching for unusual communications—are more useful than speculation about worst-case scenarios.

Were you affected?

If you are a current or former employee, client, or partner of Business Software Solutions, treat the reported listing as a reason to review your exposure rather than as proof that your specific data was taken. Change passwords on any accounts that may have been shared with or managed through the company, enable multi-factor authentication where available, and watch for unexpected emails or invoices that reference the firm. Keep an eye on credit and account activity for unusual transactions. Because the exact data types and number of people affected remain unknown, there is no definitive public list of victims. As a practical next step, you can run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets; that check will not confirm or rule out involvement in this specific incident, but it can surface other exposures that warrant attention. Official notifications, if any are issued by the company or regulators, should be treated as the authoritative source for next actions.

AICompiled with AI assistance from public sources and published under our editorial standards.