Evasión Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On October 12, 2023, the Spanish digital postproduction company Evasión was listed by the medusa ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical detail about the incident has not been disclosed.

For a firm that handles material for film, advertising, television and events, any confirmed or claimed compromise of internal systems raises practical concerns about client work, business records and the people connected to those projects. What is known so far is limited to the listing and the description of exfiltrated internal files.

Breaking down the breach

According to the available record, Evasión appeared on a medusa-associated listing dated October 12, 2023. The reported summary describes the company as a Spanish provider of digital postproduction services whose main office is at 8 2º izq. San Bernardo, Madrid, Madrid, 28015, Spain. The data types named as exposed are internal files exfiltrated in a ransomware attack. No figure has been given for the number of people affected, and public detail does not include attack vectors, encryption status, ransom demands, timelines of intrusion, or confirmation that the listing has been independently verified by the company or by law enforcement.

In short, the incident is documented as a claimed ransomware event involving exfiltration of internal files. Scale, method and full contents remain undisclosed in the material provided.

Inside medusa

Medusa is a ransomware operation known publicly for double-extortion tactics: encrypting systems while also copying data and threatening to publish it on a leak site if payment is not made. Groups operating in this model commonly list victims with varying amounts of sample data or descriptive claims to increase pressure. They have targeted organisations across multiple sectors and countries, often focusing on entities believed to hold commercially sensitive or operationally critical information.

For this incident, the record shows only that medusa listed Evasión and that internal files were described as exfiltrated. No additional claims by the group about this specific victim—such as file counts, screenshots, or named datasets—are included in the facts, and the listing itself should be treated as an unverified claim unless independently confirmed.

About Evasión

Evasión is a Spanish company that supplies digital postproduction services to the film, advertising, television and event markets. Firms in this sector typically manage project files, unfinished and finished media, client communications, scheduling and contracts, and internal business records. Their work often sits inside larger production pipelines, so disruption or exposure can affect not only the company but also agencies, broadcasters, brands and freelancers who rely on timely, confidential delivery.

A breach involving such an organisation is consequential because postproduction environments frequently contain unreleased creative assets, commercial terms and contact details for collaborators. Even when the precise scope of a given incident is unknown, the sector’s dependence on digital assets and tight release schedules makes any ransomware-related claim material to clients and partners.

What was likely exposed

The facts name the exposed material as internal files exfiltrated in a ransomware attack. They do not itemise those files. Exact contents are therefore unconfirmed.

Organisations of this kind commonly hold project media and working files, client and vendor contact information, contracts and invoices, internal correspondence, and credentials or configuration data used to run production systems. It is reasonable to expect that some mix of business and production-related records could be among internal files, but it would be inaccurate to state that any specific category—personal identity documents, payment card data, or named client reels, for example—was definitively taken. Public detail on what left the network is limited to the general description already given.

The real-world impact

For individuals whose details appear in company systems—employees, freelancers, clients or vendors—the main risks are misuse of contact information, targeted phishing that references real projects, and, if credentials or personal data were present, account takeover or identity-related fraud. Because the headcount of affected people is unknown, it is not possible to say how widely those risks extend.

For Evasión, consequences can include operational downtime, cost of investigation and recovery, contractual or reputational strain with production partners, and the need to notify clients if their materials or data were involved. Unreleased creative work, if among the internal files, could also create commercial or competitive harm if circulated. None of these outcomes is confirmed by the public record; they are the ordinary follow-on risks when internal files from a postproduction business are claimed to have been stolen.

What to do if you're exposed

If you have worked with Evasión or believe your information may have been stored in its systems, treat unsolicited messages that reference the company or specific projects with caution. Prefer official channels when verifying any request for credentials, payment or files. Monitor financial and email accounts for unusual activity, and change passwords on any accounts that may have shared credentials with work systems. Enable multi-factor authentication where available. Keep records of any suspicious contact.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach datasets. That step does not confirm involvement in this incident, but it helps you see whether your address appears in previously published collections and prioritise further protections.

AICompiled with AI assistance from public sources and published under our editorial standards.