EcoPetróleo Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 12 October 2025, the Dominican petroleum products company EcoPetróleo appeared on the leak site of the medusa ransomware group. The listing asserts that internal files were taken during a ransomware attack. Public detail remains limited: the number of people affected is unknown, and no further inventory of the material has been released. For customers, partners, employees or community contacts whose information may sit inside those files, the practical stakes are straightforward—possible exposure of personal, commercial or operational data that could be misused for fraud, phishing or competitive harm.

Because the claim originates solely from the threat actor’s site and has not been independently confirmed in the available record, the full scope and accuracy of the incident stay unverified. Still, any organisation that handles customer records, supplier contracts or environmental-project documentation carries information that, once outside its control, can create lasting risk for ordinary people.

What happened

According to the public listing dated 12 October 2025, EcoPetróleo was named by the medusa ransomware group as a victim of a ransomware attack in which internal files were exfiltrated. The report does not disclose the precise date of the intrusion, the method of initial access, the volume of data removed, or whether systems were encrypted. No official statement from EcoPetróleo confirming or denying the claim appears in the available facts. The number of individuals whose data may be involved is listed as unknown. In short, the only concrete public assertion is the group’s claim that internal files left the company’s control.

Inside medusa

Medusa is a well-documented ransomware operation that has been active for several years. Like many contemporary groups, it typically follows a double-extortion model: after gaining access to a network, operators steal data before encrypting systems, then threaten to publish the stolen material on a dedicated leak site if a ransom is not paid. The group maintains a public portal where it lists claimed victims, sometimes posting sample files or countdown timers. Medusa has previously targeted organisations across multiple sectors and geographies; its listings are therefore treated by investigators as claims rather than Reported Facts until corroborated. In this case, the appearance of EcoPetróleo on the site constitutes the group’s assertion that it holds the company’s internal files; no independent confirmation of that possession is provided in the record.

About EcoPetróleo

EcoPetróleo is a company based in the Dominican Republic that supplies petroleum products while promoting environmental conservation. Its stated activities include turtle-nesting projects, beach clean-ups and recycling programmes, and it markets itself to clients who value sustainable practices. The firm is headquartered at Avenida Rómulo Betancourt No. 527. Organisations of this type routinely hold customer account details, supplier contracts, employee records, financial documents, operational logistics data and records related to community or environmental initiatives. Because EcoPetróleo works at the intersection of energy distribution and public-facing conservation work, a breach can affect both commercial partners and individuals who have engaged with its programmes.

What was likely exposed

The only data type named in the available facts is “internal files exfiltrated in ransomware attack.” No further breakdown—such as customer lists, employee personal data, financial records or project documentation—has been disclosed. Organisations in the petroleum-products and environmental-services sector typically maintain databases of clients and suppliers, payroll and human-resources files, contracts, invoices, operational plans and records of community projects. Whether any of those categories were among the files taken remains unconfirmed. Readers should therefore treat the precise contents as unknown until more reliable information appears.

Why it matters

If internal files have left EcoPetróleo’s control, the people whose details appear in them face concrete risks: targeted phishing that references real transactions or projects, identity-related fraud, or unsolicited contact that exploits knowledge of their relationship with the company. Employees could see personal or payroll information misused; partners could face competitive disadvantage if commercial terms become public. For the organisation itself, the incident raises operational, reputational and potential regulatory questions, even though no finding of negligence has been established. Because the scale of the alleged exfiltration is unknown, the circle of potentially affected individuals cannot yet be drawn with certainty—making cautious personal monitoring the most practical immediate response.

Were you affected?

If you have done business with EcoPetróleo, participated in one of its environmental programmes, or worked for the company, treat the possibility of exposure seriously but without panic. Monitor bank and credit-card statements for unexpected activity, be alert to phishing messages that mention petroleum products, conservation projects or Dominican addresses, and consider placing fraud alerts with relevant credit agencies if you reside in a jurisdiction that offers them. Change passwords on any accounts that reused credentials linked to EcoPetróleo communications. As a further practical step, you can run a free exposure scan of your email address to check whether it has already appeared in known breach datasets; such a scan will not confirm involvement in this specific incident but can indicate whether your address has surfaced elsewhere.

AICompiled with AI assistance from public sources and published under our editorial standards.