FunkeScheid Listed by medusalocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional services firms as part of broader campaigns that combine encryption with data exfiltration. On 1 July 2026 the MedusaLocker group listed FunkeScheid, a notary practice operating as Notarkanzlei FunkeScheid in Frankfurt’s Ostend district, on its leak site. The listing states that internal files were taken during a ransomware incident and identifies 9,755 emails associated with the domain Kanzlei.FunkeScheid.com. The number of individuals whose information may be involved remains unknown.

The incident illustrates the ongoing exposure of legal and administrative organisations that hold records of contracts, property transactions and personal identifiers. Public reporting supplies no further confirmation of the volume or sensitivity of the material beyond the group’s claim and the stated email count.

What happened

MedusaLocker listed FunkeScheid on its leak site on 1 July 2026. The entry asserts that internal files were exfiltrated during a ransomware attack and references 9,755 emails linked to the practice’s domain. No independent confirmation of the data volume, encryption status or payment outcome has been published. The number of people potentially affected is not stated.

Who is medusalocker?

MedusaLocker is a ransomware-as-a-service operation that has been active since at least 2019. The group typically gains access through remote-desktop services or phishing, deploys custom encryption malware, and exfiltrates selected files before demanding payment. When victims decline to pay, the group publishes file listings or samples on a Tor-based leak site to increase pressure. It has previously claimed victims across manufacturing, healthcare, legal services and local government. Attribution of any specific incident rests on the group’s own statements unless corroborated by the affected organisation or law-enforcement findings.

FunkeScheid and its sector

FunkeScheid operates as a Notarkanzlei, a German notary office authorised to authenticate contracts, wills, property transfers and corporate filings. Such practices routinely process personal data including names, addresses, identification documents, financial details and the substance of private legal arrangements. Because notary records often remain relevant for decades, any exposure can affect both current clients and parties to transactions completed years earlier.

The information in question

The only data type explicitly named in public reporting is “internal files exfiltrated in ransomware attack,” together with the figure of 9,755 emails. The precise categories of information contained in those files have not been disclosed. Organisations of this type commonly hold client identifiers, contract terms, property records and correspondence; however, the exact contents of the material claimed by the group remain unconfirmed.

The real-world impact

Exposure of notary correspondence and attached documents can reveal details of property ownership, inheritance arrangements and commercial agreements that are otherwise private. Individuals named in such records may face risks of identity misuse or targeted fraud, while the firm itself may encounter regulatory scrutiny under data-protection rules and reputational consequences within its professional community. No confirmed instances of subsequent misuse have been reported at this stage.

If your data was in this claimed breach

Monitor bank and credit accounts for unusual activity and consider placing fraud alerts with credit bureaus. Review any recent correspondence from FunkeScheid for guidance the firm may issue. Readers can run a free exposure scan of their email address against known breach data sets to determine whether their information appears in publicly referenced incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.