dulay.ca Listed by medusalocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 17, 2025, the ransomware group medusalocker listed dulay.ca on its data-leak site. The listing states that 500 gigabytes of internal files were taken during a ransomware operation and are being offered for sale at a price of $40,000, with additional profit-making options noted in the post. No confirmation of the claim has been made public by dulay.ca, and the number of individuals whose information may be involved remains unknown. This incident follows the common pattern in which ransomware operators combine encryption of systems with the threat of publishing or selling stolen data. The public posting itself constitutes the primary record available at this time.

Breaking down the breach

The only confirmed public detail is the November 17, 2025 listing on the medusalocker site. The group asserts that internal files were exfiltrated and that the total volume reaches 500 gigabytes. No independent verification of the volume, the timing of the intrusion, or the method of initial access has been released. The number of people potentially affected is not stated in the available record.

Inside medusalocker

Medusalocker is a ransomware operation that has been publicly tracked since at least 2020. Like several other groups active in the same period, it employs a double-extortion model: systems are encrypted and data is copied before ransom demands are issued. The group maintains a leak site where it posts names of organizations it claims to have targeted, often accompanied by sample files or sale offers. Such listings are presented by the operators themselves and are not independently audited.

dulay.ca and its sector

Dulay.ca operates under a Canadian domain and therefore falls under Canadian privacy and data-protection expectations. Organizations using .ca domains commonly handle client records, internal correspondence, financial documentation, or operational systems. Any compromise of such an entity can expose material that is not normally intended for public release, regardless of the precise nature of the business.

The information in question

The listing refers only to “internal files.” No inventory of specific data categories, such as customer records, employee information, or financial documents, has been published. While organizations of this type routinely store contact details, contracts, and administrative records, the exact contents of the claimed 500-gigabyte archive remain unconfirmed beyond the group’s own description.

What's at stake

If the files contain personal or confidential information, affected individuals could face risks of identity misuse, targeted fraud, or unwanted disclosure of private details. For the organization, the incident may result in regulatory scrutiny under Canadian privacy law and costs associated with investigation and remediation. The absence of a disclosed count of affected people makes it difficult to assess the full scope at present.

If your data was in this claimed breach

Individuals who have any connection to dulay.ca should monitor their financial and email accounts for unusual activity and consider placing fraud alerts with credit-reporting agencies. Changing passwords for any accounts linked to the organization remains a standard precaution. Readers can also run a free exposure scan of their email address against known breach data sets to determine whether their information appears in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.