Camp Susque Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In early August 2024, the Pennsylvania outdoor camp Camp Susque appeared on a ransomware group’s leak site, with the group claiming it had taken and was prepared to release internal files. For families who have sent children to camp, staff and volunteers who work there, and anyone who has booked a retreat or rental, the practical question is whether personal details, contact information, medical notes, or payment records could now be in the hands of criminals. The number of people affected has not been made public, so the scale of individual risk remains unclear.

What is known is limited to the listing itself, a reported data volume, and the organisation’s basic profile. That is enough to warrant careful attention from anyone connected to the camp, but not enough to confirm exactly whose records were taken or how they might be misused.

What happened

On or around 1 August 2024, Camp Susque was listed by the ransomware group known as medusa. The group claims that internal files were exfiltrated during a ransomware attack and that the total volume of data involved is 48.9 GB. Public reporting does not disclose when the intrusion began, how the attackers gained access, whether systems were encrypted, or whether any ransom demand was paid or refused. The number of people whose information may be included is unknown. Beyond the leak-site listing and the stated data volume, further technical and operational details of the incident remain undisclosed.

Inside medusa

Medusa is a well-documented ransomware operation that has been active for several years. The group typically follows a double-extortion model: it encrypts systems where possible and simultaneously steals data, then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. Listings on that site are the group’s primary public pressure tactic; they often include sample files or volume claims to demonstrate possession of data. Medusa has previously targeted organisations across multiple sectors, including education, healthcare, and smaller commercial entities. Its operators are known to use common initial-access methods such as compromised credentials or unpatched remote services, though the specific method used against any given victim is rarely confirmed publicly. In this case, the appearance of Camp Susque on the leak site should be treated as an unverified claim by the group rather than independent confirmation of every detail asserted.

Who is Camp Susque?

Camp Susque is a long-established outdoor and Christian camp founded in 1947 and located in the mountains of north-central Pennsylvania. Its corporate office is at 47 Susque Camp Road, Trout Run, Pennsylvania. The organisation reports a small staff of approximately 16 employees and offers wilderness trips, family camps, winter camps, homeschool classes, field trips, and retreat and rental facilities. Camps of this type routinely collect and store personal information about minors and their parents or guardians, staff and volunteer applications, medical and allergy records, emergency contacts, and payment or registration details. A breach at such an organisation is consequential because the data often involves children, because records may span many years of seasonal programmes, and because the camp’s community is built on trust between families and the organisation that cares for their children.

What was likely exposed

The only data type named in public reporting is “internal files” said to have been exfiltrated in a ransomware attack, with a claimed total volume of 48.9 GB. Exact contents have not been disclosed or independently verified. Organisations of this kind typically hold the following categories of information; whether any or all of them were among the files taken remains unconfirmed:

• Camper and family registration records, including names, ages, addresses, and emergency contacts
• Medical forms, allergy lists, and medication authorisations for minors
• Staff, volunteer, and contractor personnel files and background-check related data
• Financial and payment information tied to registrations, rentals, or donations
• Internal administrative documents, schedules, and correspondence

Until the organisation or independent investigators release a confirmed inventory, any assumption about specific records is speculative.

What's at stake

For individuals, the main risks are identity theft, targeted phishing or social-engineering attempts that reference camp details, and potential misuse of medical or family information. Because many records involve children, the sensitivity is higher than for ordinary adult customer data. Parents may also face secondary exposure if their own contact or payment details appear alongside a child’s file. For the organisation, the stakes include operational disruption, loss of community trust, possible regulatory scrutiny under state privacy and child-protection rules, and the long-term cost of notification, credit monitoring, and security improvements. The small size of the staff means recovery and communication burdens fall on a limited number of people. None of these outcomes is inevitable; they depend on what was actually taken and how it is later used.

What to do if you're exposed

If you or your family have had any connection to Camp Susque—past or present camper, staff, volunteer, or rental guest—treat the situation as a potential exposure until clearer information emerges. Practical first steps include monitoring bank and credit-card statements for unfamiliar charges, placing a free fraud alert or credit freeze with the major credit bureaus, and being especially cautious of emails or calls that claim to come from the camp or that reference specific programme details. Change passwords on any accounts that may have reused credentials linked to camp registrations. Keep records of any suspicious contact. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach datasets; such a scan will not prove or disprove involvement in this specific incident, but it can surface other exposures that warrant attention. Official updates, if any, should come from Camp Susque itself or from law-enforcement or regulatory notices rather than from the ransomware group’s site.

AICompiled with AI assistance from public sources and published under our editorial standards.