EHPAD Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On October 23, 2023, the French nursing-home operator EHPAD was listed by the Medusa ransomware group, which claimed to have carried out a ransomware attack and exfiltrated internal files. The number of people affected remains unknown, and public detail on the incident is limited to the group's listing and the description of internal files taken.

Because EHPAD provides accommodation and care for elderly dependents across several branches in France, any exposure of internal material raises concrete questions for residents, families and staff about what may have left the organisation's systems.

Inside the incident

According to the available record, EHPAD appeared on Medusa's leak site on or around October 23, 2023. The group asserted that internal files had been exfiltrated in a ransomware attack. No confirmed figure for the volume of data, no technical description of the intrusion method, and no independent verification of the claim have been made public. The number of individuals whose information may be involved is listed as unknown. Timing beyond the reported date, the precise systems affected, and whether encryption was also deployed on EHPAD networks are undisclosed.

In short, the incident is known principally through the threat actor's listing; further operational detail has not been released in the material available for this account.

Who is medusa?

Medusa is a ransomware operation that has been publicly documented since at least 2021. Like many contemporary groups, it typically follows a double-extortion model: operators seek to encrypt victim systems while also copying data, then threaten to publish the stolen material if a ransom is not paid. The group maintains a leak site on which it names organisations and, in some cases, releases sample files or larger archives. Medusa has previously listed victims across multiple sectors and countries; its public posts are claims by the actors themselves and are not automatically confirmed by the named organisations or by independent investigators.

In this instance, the sole specific assertion tied to EHPAD is the listing and the statement that internal files were exfiltrated. No additional claims by Medusa about this victim—such as ransom demands, file counts or publication deadlines—are recorded in the facts at hand.

About EHPAD

EHPAD is a French commercial institution that provides accommodation and care for elderly dependents—commonly known as a nursing-home operator. It maintains several branches in France; its main office is recorded at 69 Rue République, Trun, Normandy, 61160. Organisations of this type sit at the intersection of healthcare, residential services and personal administration. They routinely handle medical histories, medication records, identity and contact details of residents and next of kin, staffing and payroll data, and operational documents needed to run multiple sites.

A breach affecting such an operator is consequential because the people served are often older, may have diminished capacity to monitor their own affairs, and depend on the continuity and confidentiality of care-related information. Families and staff are also drawn into the same data environment.

The information in question

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data categories—such as medical records, identity documents, financial details or staff files—has been disclosed. Exact contents therefore remain unconfirmed.

Nursing-home operators of EHPAD's kind typically hold resident identification and civil-status data, health and care plans, emergency contacts, billing and insurance information, and employee records. Whether any or all of those categories were among the files Medusa claims to have taken is not established in the public record. Readers should treat the scope of exposure as unknown until corroborated by the organisation or by competent authorities.

Why it matters

For residents and their families, the practical risks centre on privacy and potential misuse of personal or health-related information. Even without confirmed data types, internal files from a care provider can contain material that, if circulated, could enable targeted fraud, unwanted contact, or embarrassment. Older adults may be less able to detect or contest identity misuse, which raises the stakes of any leak.

For the organisation, a claimed ransomware incident can disrupt operations, strain trust with families and regulators, and create lasting uncertainty about what left its systems. Because the scale and precise contents are undisclosed, both the human and institutional impact remain difficult to quantify; the absence of detail itself prolongs that uncertainty.

If your data was in this claimed breach

If you are a resident, family member or employee connected with EHPAD, consider the following practical steps while public information remains limited:

• Contact EHPAD through official channels to ask whether your records were involved and what support is being offered.
• Monitor bank, insurance and administrative accounts for unexpected activity and enable additional verification where available.
• Be cautious of unsolicited calls, messages or emails that reference care arrangements or personal details; verify any request independently.
• Request copies of your own data held by the organisation if you wish to understand what is on file.
• Run a free exposure scan of your email addresses to check whether they have already appeared in known breach data sets elsewhere.

Keep records of any correspondence. Further clarity, if it emerges, is most likely to come from the organisation or from official notifications rather than from threat-actor sites.

AICompiled with AI assistance from public sources and published under our editorial standards.