Dolmor Salon Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 23, 2025, Dolmor Salon, a hairdressing and styling business based in Simcoe, Ontario, was listed by the medusa ransomware group as a victim of a ransomware attack. Public reporting indicates that internal files were exfiltrated. The number of people affected remains unknown, and further specifics about the incident have not been disclosed. For a small local service business, any unauthorized access to internal records raises practical concerns for clients, staff, and day-to-day operations, even when the full scope is still unclear.

What is known so far comes from the group's public listing and limited accompanying detail. No independent confirmation of the full extent of the compromise has been made public, and the precise timeline, entry method, and volume of data involved have not been released. This article sets out the available facts, places them in context, and outlines the concrete steps people can take if they believe their information may have been involved.

Breaking down the breach

According to the reported summary, Dolmor Salon was listed by the medusa ransomware group on or around January 23, 2025. The listing states that internal files were exfiltrated in a ransomware attack. No figure has been given for the number of individuals affected, and no detailed inventory of the files has been published. Timing of the initial intrusion, the technical method used, and whether systems were encrypted in addition to data theft remain undisclosed.

Public detail is limited to the claim of exfiltration of internal files. There is no confirmed information on whether customer records, employee data, financial documents, or other categories were among those files. Until more is released by the organisation or verified through independent reporting, the scale and exact contents of the incident stay unconfirmed.

The group behind it: medusa

Medusa is a ransomware operation that has been active in recent years and is known for a double-extortion model: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. The group typically maintains a leak site where it lists organisations it claims to have compromised, often posting samples or full data dumps when negotiations fail or deadlines pass. Like other ransomware-as-a-service actors, medusa has targeted a range of sectors, including smaller businesses that may have fewer dedicated security resources.

In this case, the group claims Dolmor Salon as a victim and asserts that internal files were taken. That listing is an unverified claim by the threat actor; it does not by itself constitute independent confirmation of every detail. Medusa's established pattern is to use the threat of public release as leverage, but no further statements specific to this incident beyond the listing itself have been provided in the available facts.

Dolmor Salon and its sector

Dolmor Salon was founded in 1952 and provides services of hairdressers and stylists. Its corporate office is located at 42 Kent St N, Simcoe, Ontario, N3Y 3S2, Canada, and the business has 11 employees. As a long-standing local salon, it operates in the personal-care and beauty services sector, where client relationships often involve repeated appointments, contact details, and sometimes payment or loyalty information.

Organisations of this type typically maintain records needed for scheduling, client preferences, staff management, and basic accounting. A breach at a small salon can be consequential because the business holds personal information about local customers and a small workforce, and because operational disruption or loss of trust can affect a community-facing enterprise more sharply than a large corporation with greater resources to absorb the impact. The limited public footprint of such businesses also means that detailed technical disclosures are often sparse.

The information in question

The available facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of data types—such as names, addresses, phone numbers, email addresses, appointment histories, payment card details, or employee records—has been disclosed. Exact contents therefore remain unconfirmed.

Businesses in the hairdressing and styling sector commonly hold client contact information, booking histories, notes on services or preferences, and basic employee and financial records. They may also store limited payment or marketing data. Because the facts do not name specific categories beyond "internal files," it is not possible to state what was actually taken. Anyone associated with the salon should treat the possibility of personal or contact data exposure as open until more precise information is released.

The real-world impact

For individuals whose information may have been among the internal files, the primary risks are practical rather than dramatic: unwanted contact, phishing attempts that reference the salon or local details, or misuse of contact and identity information if such data was present. Without confirmed data types or numbers of people affected, the precise level of risk cannot be quantified. Staff could face similar concerns if employee records were involved, along with potential disruption to payroll or scheduling systems.

For Dolmor Salon itself, the incident carries operational and reputational consequences. Ransomware events often interrupt normal service, require forensic and recovery work, and prompt questions from clients. A small business with 11 employees has limited capacity to absorb prolonged downtime or the cost of remediation. Public listing by a ransomware group can also create lasting uncertainty among customers even when the full technical picture is incomplete. None of these outcomes imply established fault; they simply describe the ordinary pressures that follow such claims.

If your data was in this claimed breach

If you are a client or employee of Dolmor Salon, begin by monitoring accounts and communications for unusual activity. Change passwords on any accounts that may have reused credentials linked to the salon, and enable multi-factor authentication where available. Be cautious of unsolicited messages that reference the salon, appointments, or personal details, as these can be phishing attempts. Consider placing fraud alerts with credit agencies if you believe financial or identity data could be involved, and review bank or card statements for unexpected charges.

Because the exact contents of the exfiltrated files remain unconfirmed, treat any notification from the salon as the most reliable source of next steps. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Stay alert to official updates from the organisation rather than relying solely on threat-actor claims.

AICompiled with AI assistance from public sources and published under our editorial standards.