Comwave Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 17, 2024, Comwave, a Canadian communications provider, was listed by the Medusa ransomware group as a victim of a ransomware attack. Public reporting indicates that the group claims internal files totaling 274.8 GB were exfiltrated. The number of people affected remains unknown, and further details about the incident’s timeline or confirmation of the listing have not been disclosed.

This matters because Comwave supplies home internet, television, and phone services to customers in Canada. Any exposure of internal corporate material from a telecommunications firm can raise practical concerns for the organisation and, depending on what was taken, for individuals whose information may appear in those files.

Breaking down the breach

According to the available record, Comwave was listed by the Medusa ransomware group on or around May 17, 2024. The group claims that internal files were exfiltrated during a ransomware attack and that the volume of data involved is 274.8 GB. No public confirmation of the attack’s success, the precise date of intrusion, or the encryption status of systems has been provided in the facts. The number of individuals potentially affected is listed as unknown. Methodological details beyond the description of a ransomware attack with data exfiltration are undisclosed. The corporate office address associated with Comwave is given as 61 Wildcat Rd, Toronto, Ontario, M3J 2P5, Canada, and the organisation is reported to have 235 employees. These figures come from the breach summary and do not themselves confirm the scope of any compromise.

Inside medusa

Medusa is a ransomware operation that has been publicly documented for several years. Like many groups in this category, it typically employs a double-extortion model: encrypting systems while also stealing data and threatening to publish it on a leak site if a ransom is not paid. Listings on such sites are claims made by the group; they are not independent verification that a breach occurred or that the stated volume of data is accurate. Medusa has previously claimed responsibility for attacks against organisations across multiple sectors, often publishing samples or full archives after a countdown period. Public reporting on the group emphasises its use of standard ransomware tooling, affiliate models, and pressure tactics aimed at forcing payment. Nothing in the present facts attributes specific statements by Medusa about Comwave beyond the listing itself and the claimed 274.8 GB of internal files.

Comwave and its sector

Comwave is described as Canada’s communications company offering home internet, TV, and phone services. It operates from a corporate office in Toronto and employs roughly 235 people. Telecommunications and internet-service providers sit at a sensitive intersection of consumer data, network infrastructure, and billing systems. Organisations of this type routinely manage customer account records, service-usage information, payment details, and internal operational documents. A ransomware incident at such a firm is consequential because it can disrupt service continuity for households and small businesses that rely on connectivity, and because any internal files that leave the organisation may contain material useful for further social-engineering or fraud attempts. The facts do not establish that customer systems were affected or that service outages occurred; they simply record the listing and the claimed data volume.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack and that the total amount of data leakage claimed is 274.8 GB. No more granular inventory—such as customer databases, employee records, financial documents, or source code—is named. Because the exact contents remain unconfirmed, it is not possible to assert which categories of personal or corporate information, if any, are present. Organisations in the communications sector typically hold customer contact details, service addresses, billing histories, and internal administrative files. Whether any of those categories appear in the claimed 274.8 GB archive is unknown. The number of people affected is likewise listed as unknown.

What's at stake

For individuals, the primary risks associated with any internal corporate files that may contain personal data include identity-related fraud, targeted phishing, and unsolicited contact that leverages accurate account or address information. Because the precise contents are unconfirmed, these risks remain potential rather than proven. For Comwave itself, the stakes include operational disruption, regulatory scrutiny under Canadian privacy rules, reputational damage, and the cost of investigation and remediation. The 274.8 GB figure, if accurate, represents a substantial volume of material whose uncontrolled circulation could prolong those consequences. No dollar amounts, ransom demands, or confirmed customer impacts appear in the public facts.

What to do if you're exposed

If you are a current or former Comwave customer or employee and are concerned that your information may have been involved, begin by monitoring account statements and credit reports for unexpected activity. Enable multi-factor authentication on email and financial accounts, and treat unsolicited messages that reference Comwave services with caution. Change passwords on any accounts that reused credentials associated with the company. Because the number of people affected and the exact data types remain unknown, these steps are precautionary. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Official notifications, if any are issued by Comwave or Canadian authorities, should be followed carefully for tailored guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.