DeVita & Associates, Inc. Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional services firms that hold project files, client records and operational data, using double-extortion tactics that combine encryption with public leak-site pressure. In this landscape, smaller and mid-sized engineering practices have become frequent listings because their systems often contain concentrated technical and commercial information that can be leveraged for ransom demands.

On 13 May 2025, DeVita & Associates, Inc., a Greenville, South Carolina engineering firm, was listed by the medusa ransomware group. The group claims that 618.40 GB of internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and public detail beyond the listing itself is limited. The incident matters because the firm’s work involves structural, mechanical and electrical design data that can affect clients, partners and ongoing projects if misused.

What happened

According to the reported listing, DeVita & Associates, Inc. was named by the medusa ransomware group on 13 May 2025. The group asserts that internal files were exfiltrated as part of a ransomware attack and that the total volume of data taken amounts to 618.40 GB. No further public confirmation of the intrusion method, the precise date of initial access, or the full scope of systems affected has been disclosed. The number of individuals whose information may have been involved is listed as unknown. Available facts do not describe whether systems were encrypted, whether a ransom was demanded or paid, or whether the company has issued its own statement.

Inside medusa

Medusa is a well-documented ransomware operation that has operated as a ransomware-as-a-service model, recruiting affiliates to conduct intrusions while the core group manages negotiation and leak-site publication. The group typically employs double extortion: after gaining access, operators exfiltrate data and then encrypt systems, threatening to publish the stolen material on a dedicated leak site if payment is not made. Public reporting on medusa has described its use of common initial-access vectors such as compromised credentials, phishing and exploitation of exposed remote services, followed by lateral movement and large-scale data theft before encryption. Listings on its site are claims by the group; they do not by themselves constitute independent verification that every asserted detail is accurate. In this case, the only specific claim tied to DeVita & Associates is the listing itself and the stated 618.40 GB volume of internal files.

DeVita & Associates, Inc. and its sector

DeVita & Associates, Inc. was founded in 1984 and provides mechanical, electrical and structural engineering services, including specialised structural precast design and detailing. Its corporate office is located at 1150 E Washington St, Greenville, South Carolina, 29601, and the firm employs 114 people. Engineering consultancies of this type routinely handle design drawings, calculation packages, project specifications, client correspondence, contracts and internal operational records. A breach at such an organisation is consequential because the data often includes proprietary technical work product, client project details and commercial information that can affect multiple parties beyond the firm itself. Even when personal data volumes are not publicly quantified, the concentration of project and business records creates both operational and reputational exposure for the company and potential downstream risk for clients whose projects appear in the files.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack and that the claimed volume is 618.40 GB. No more granular inventory of file types, categories of personal information, or specific client or employee records has been publicly disclosed. Organisations in the engineering sector typically hold design documents, structural calculations, project schedules, contracts, invoices, employee records and client contact information. Because the exact contents of the 618.40 GB remain unconfirmed beyond the general description of “internal files,” it is not possible to state with certainty which of these categories, if any, were included. Readers should treat any more detailed claims as unverified until corroborated by the company or independent reporting.

The real-world impact

For individuals whose information may appear in the exfiltrated material, the practical risks include potential misuse of contact details, project-related personal identifiers or any credentials that might have been stored in internal systems. Because the number of people affected is unknown and the precise data types are not itemised, the scale of personal exposure cannot be quantified from public sources. For DeVita & Associates, the consequences can include disruption to ongoing design work, the need to notify clients and partners, possible regulatory notification obligations depending on the nature of any personal data involved, and the longer-term cost of investigation, remediation and reputation management. Clients whose project files may have been taken face the secondary risk that proprietary design information or commercial terms could be exposed, which can affect competitive position or contractual relationships. None of these outcomes is automatic; they depend on what was actually contained in the files and how the data is subsequently handled.

What to do if you're exposed

If you have a past or present relationship with DeVita & Associates—as an employee, client, contractor or project partner—monitor financial and email accounts for unusual activity and consider placing a fraud alert with the major credit bureaus if you believe personal identifiers may have been involved. Change passwords on any accounts that may have shared credentials or been accessed through work systems, and enable multi-factor authentication wherever available. Retain any official notices the company may issue and follow their guidance on next steps. As a practical check, you can run a free exposure scan of your email address to see whether it has already appeared in known breach datasets; this does not confirm involvement in this specific incident but can surface other exposures that warrant attention. Remain cautious of unsolicited messages that reference the breach and request personal information or payment, as such messages are a common follow-on tactic after public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.