DSI Tech Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 14, 2025, the ransomware group known as medusa listed DSI Tech on its leak site, claiming to have exfiltrated internal files totaling 399.10 GB. The number of people whose information may be involved remains unknown, and public detail on the precise contents of those files is limited. For employees, partners, clients, and others whose records could sit inside a technology reseller’s systems, the practical stakes are straightforward: internal business files can contain contact details, contracts, credentials, and operational records that, once outside the organisation, raise the risk of phishing, fraud, or further unauthorised access.

This article sets out only what has been reported, places the claim in context, and outlines concrete steps people can take while the full picture remains incomplete.

Breaking down the breach

According to the available record, DSI Tech was listed by the medusa ransomware group on May 14, 2025. The group claims that internal files were exfiltrated in a ransomware attack and that the total volume of data leakage is 399.10 GB. No confirmed figure for the number of individuals affected has been published. The method of initial access, the exact date the intrusion began, and whether a ransom was demanded or paid are all undisclosed in the public summary. The listing itself is a claim by the threat actor; independent confirmation of the full scope has not been stated in the facts provided.

What is known is therefore narrow: a named organisation, a reported listing date, a claimed data volume, and a description of the material as internal files obtained through a ransomware incident. Everything else—timing of the attack, technical vectors, and verification of the dump—remains unconfirmed at the time of reporting.

Who is medusa?

Medusa is a well-documented ransomware operation that has appeared in public reporting for several years. Like many contemporary groups, it typically follows a double-extortion model: encrypting systems while also copying data, then threatening to publish the stolen material on a dedicated leak site if payment is not made. The group has previously listed a range of organisations across sectors, using the public listing both as pressure and as a way to advertise its activity. Its leak-site posts generally include a victim name, a claimed data volume, and sometimes sample files; these posts are assertions by the operators and are not independently verified at the moment of publication.

In this case, the facts state only that medusa listed DSI Tech and claimed 399.10 GB of internal files. No additional statements attributed to the group about this specific victim—such as sample screenshots, ransom amounts, or deadlines—are included in the record, so none are reported here.

DSI Tech and its sector

DSI Tech was founded in 1991 and is described as a certified minority-owned small business that operates as an IT value-add reseller and service provider of industry vendor products and solutions. Its corporate office is located at 44670 Cape Ct Ste 100, Ashburn, Virginia, 20147, United States, and it employs 223 people. Organisations of this type sit between technology vendors and end customers: they resell hardware and software, provide implementation and support services, and often hold contracts, configuration data, and customer or partner records needed to deliver those services.

A breach affecting an IT reseller is consequential because the firm’s systems can contain information that extends beyond its own workforce—client contact lists, project documentation, licensing details, and internal operational files. Even when the exact contents of an exfiltration remain unconfirmed, the sector’s role as a trusted intermediary means that any compromise can create secondary risk for the organisations and individuals who rely on its services.

What data was at risk

The facts name the exposed material as “internal files exfiltrated in ransomware attack” and give a claimed volume of 399.10 GB. No further breakdown of file types, databases, or personal data categories has been disclosed. Organisations that function as IT resellers and service providers typically hold employee records, customer and partner contact information, contracts, invoices, technical configurations, and internal correspondence. Whether any of those categories were present in the claimed 399.10 GB is unconfirmed. Public detail is limited to the description “internal files,” so no specific personal-data types can be stated as fact.

The real-world impact

For individuals whose information may have been among the internal files, the concrete risks include targeted phishing that references real business relationships, attempts to reuse credentials if any were stored, and the possibility of identity-related fraud if personal details appear in the material. Because the number of people affected is unknown and the exact contents are unconfirmed, the scale of these risks cannot be quantified from the public record.

For DSI Tech itself, the listing creates operational and reputational pressure: systems may have been disrupted by encryption, recovery costs can be substantial, and clients may reassess their trust in the firm’s security posture. The claimed data volume of 399.10 GB, if accurate, represents a sizable internal archive whose exposure could affect ongoing contracts and service relationships. None of these outcomes is asserted as proven; they are the ordinary consequences that follow when a ransomware group claims to hold an organisation’s internal files.

If your data was in this claimed breach

If you have a past or present connection to DSI Tech—as an employee, contractor, client, or partner—treat the listing as a reason to take basic protective steps while further details remain limited.

• Monitor financial and email accounts for unexpected activity or messages that reference DSI Tech or related projects.
• Change passwords on any accounts that may have been used in connection with the company, and enable multi-factor authentication where available.
• Be cautious of unsolicited calls or emails that claim to be from DSI Tech or that request sensitive information; verify through known channels.
• Consider placing a fraud alert with credit-reporting agencies if you believe personal identifiers could have been involved.
• Run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets.

Public information on this incident is still incomplete. The medusa listing and the claimed 399.10 GB of internal files are the core facts reported to date; everything else awaits confirmation. Staying alert to unusual contact and reviewing your own account security remain the most practical immediate responses.

AICompiled with AI assistance from public sources and published under our editorial standards.