County Connection Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 17, 2024, the public transit agency County Connection appeared on a listing associated with the medusa ransomware group. The listing claims that internal files totaling 100 GB were taken in a ransomware attack. The number of people whose information may be involved remains unknown, and public detail on exactly which records were copied is limited. For riders, employees, and partners who rely on the agency, the practical stakes are straightforward: any personal or operational data that left the network could later be misused for fraud, identity theft, or further targeting.

What is confirmed so far is modest. County Connection, legally the Central Contra Costa Transit Authority, provides fixed-route and paratransit bus service across multiple Contra Costa County communities. The claim that 100 GB of internal files were exfiltrated is the central public assertion; independent verification of the full scope has not been released in the available record.

What happened

According to the reported summary, County Connection was listed by the medusa ransomware group on May 17, 2024. The group claims that internal files were exfiltrated during a ransomware attack and that the total volume of data taken is 100 GB. No public figure has been given for the number of individuals affected. Timing of the initial intrusion, the precise method of entry, and whether systems were encrypted in addition to data theft are not disclosed in the available facts. The incident is therefore known primarily through the leak-site listing itself, which must be treated as an unverified claim until further official confirmation appears.

County Connection operates from its corporate office at 2477 Arnold Industrial Way in Concord, California. The agency was formed in 1980 as a Joint Powers Agency. Beyond the volume figure and the description “internal files,” no additional technical indicators or forensic findings have been made public in the source material.

The group behind it: medusa

Medusa is a well-documented ransomware operation that has appeared in numerous public reports since roughly 2021. Like many contemporary groups, it typically follows a double-extortion model: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. The group maintains a leak site where it posts victim names, sample files, and countdown timers. Listings are marketing claims by the actors; they do not automatically prove that every asserted detail is accurate or that the full data set has been released.

Public reporting has associated medusa with attacks on organizations across multiple sectors, including government, education, and transportation-related entities. The group’s operators are known to pressure victims by threatening to dump stolen files and, in some cases, by contacting journalists or customers. None of those general tactics should be read as confirmed actions specific to County Connection beyond the simple fact of the listing and the stated 100 GB figure. The claim that County Connection’s internal files were taken remains just that—a claim originating from the threat actors.

County Connection and its sector

County Connection is a public transit provider serving Concord, Pleasant Hill, Martinez, Walnut Creek, Clayton, Lafayette, Orinda, Moraga, Danville, San Ramon, and surrounding communities in California. As a Joint Powers Agency created in 1980 under the legal name Central Contra Costa Transit Authority, it operates fixed-route buses and paratransit services. Public transit agencies of this type routinely maintain employee records, contractor information, operational schedules, maintenance logs, financial data, and, in many cases, limited rider or eligibility information for paratransit programs.

A breach at such an organization is consequential because the data often mixes sensitive personal details of staff with operational material that could affect service continuity or public safety planning. Even when the exact contents remain unconfirmed, the combination of workforce data and internal documents creates both privacy and operational risk. The agency’s role as a local government-related service provider also means that any disruption or data exposure can erode public trust in essential mobility services.

What was likely exposed

The facts state that internal files were exfiltrated and that the total amount of data leakage is 100 GB. No further breakdown of file types, databases, or specific categories of personal information has been disclosed. Organizations of this kind typically hold personnel files, payroll and benefits data, vendor contracts, route and scheduling information, maintenance records, and correspondence. Whether any of those categories were among the 100 GB is unconfirmed.

Because the precise contents remain undisclosed, it is not possible to state as fact that particular fields—such as Social Security numbers, driver’s license numbers, or medical eligibility data—were taken. The only concrete public assertion is the volume and the description “internal files.” Readers should treat any more granular claims as speculative until official notifications or forensic reports appear.

Why it matters

For individuals whose data may have been among the internal files, the real-world risks are familiar: possible identity theft, phishing campaigns that reference accurate personal details, and long-term monitoring of credit or benefits accounts. Employees and contractors face the additional possibility that payroll or human-resources records could be used for targeted fraud. For the agency itself, the exposure of operational documents can complicate service planning, vendor relationships, and regulatory compliance. Even when encryption of systems is not confirmed, the mere fact of data leaving the network creates lasting uncertainty.

Because the number of people affected is unknown, the practical impact cannot yet be quantified. That uncertainty itself is a cost: people who interact with County Connection—riders, staff, or partners—have limited information with which to decide how urgently to act. Calm, measured steps remain the most useful response while further details are awaited.

What to do if you're exposed

If you are an employee, contractor, or frequent rider of County Connection and believe your information could have been involved, the following steps are practical first measures:

• Watch for official notices from the agency or from state regulators; these will describe any confirmed data types and any free credit-monitoring offers.
• Place a free fraud alert or credit freeze with the major credit bureaus if you suspect personal identifiers were among the files.
• Treat unexpected emails or calls that reference County Connection or transit benefits with caution; verify through known official channels before responding.
• Review recent account statements and benefits records for unfamiliar activity and change passwords on any work-related accounts you control.
• Run a free exposure scan of your email address against known breach data sets to see whether your information has already appeared in public dumps.

These actions do not require waiting for every detail to be confirmed. They reduce the chance that stolen data, if it exists, can be used against you while the full picture of the 100 GB claim continues to develop.

AICompiled with AI assistance from public sources and published under our editorial standards.