Glow Medi Spa Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure smaller healthcare and wellness providers, where patient records and operational data sit alongside limited security resources. Against that backdrop, Glow Medi Spa was listed by the Medusa ransomware group on 3 February 2025. Public detail remains limited: the group claims internal files were exfiltrated during a ransomware attack, yet the number of people affected and the precise contents of those files have not been confirmed. For clients and staff of a Toronto medical-spa business, even an unverified claim raises concrete questions about privacy and next steps.

What is known so far is modest and rests almost entirely on the group’s own leak-site listing. No independent confirmation of the intrusion, the volume of data, or any ransom demand has entered the public record. That scarcity of verified information is itself typical of many recent incidents involving mid-sized clinics and spas.

Inside the incident

According to the available record, Glow Medi Spa appeared on Medusa’s leak site on 3 February 2025. The listing describes the organisation as a spa centre offering medical services and states that internal files were exfiltrated in a ransomware attack. No further technical details—such as the initial access vector, the date of compromise, the volume of data taken, or any encryption of systems—have been disclosed. The number of individuals whose information may be involved is listed as unknown. Public reporting has not confirmed whether the organisation has acknowledged the claim, engaged with the group, or restored operations. In short, the incident is known primarily through the threat actor’s assertion; independent verification of scale, method, or impact remains unavailable.

Because the facts supply only the listing date, the organisation’s identity, and the generic description “internal files,” any reconstruction beyond those points would be speculation. Readers should treat the Medusa claim as unverified until additional evidence appears.

Inside medusa

Medusa is a well-documented ransomware operation that has operated for several years under a double-extortion model. The group typically gains access to a network, exfiltrates data, encrypts systems, and then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. Affiliates often handle initial intrusion while core operators manage negotiations and data dumps. Public reporting has linked Medusa to attacks across healthcare, manufacturing, education, and professional services; the group’s leak site has previously named organisations of varying sizes, including smaller clinics and service providers. Its listings routinely assert that “internal files” or “databases” were taken, yet the accuracy of those claims is not independently audited at the moment of publication. Nothing in the public record for this case goes beyond Medusa’s own assertion that Glow Medi Spa’s internal files were exfiltrated; no specific ransom figure, sample files, or additional statements unique to this victim have been reported.

Who is Glow Medi Spa?

Glow Medi Spa is described in the available summary as a spa centre that also provides medical services. Its corporate office is listed at 129 Yorkville Ave, Floor 4, Toronto, Ontario, M5R 1C4, Canada, and the organisation is reported to employ approximately ten people. Businesses of this type typically combine aesthetic treatments with medically supervised procedures—Botox, laser therapies, skin diagnostics, and related consultations—placing them at the intersection of hospitality and regulated healthcare. Even a small staff can maintain appointment systems, medical charts, payment records, and employee files. A breach claim against such an organisation is consequential because the data it holds often includes health-related information that is both sensitive and regulated under Canadian privacy law. Clients may have shared medical histories, photographs, or contact details under an expectation of confidentiality; staff may have payroll and identification records on the same systems. The modest size of the workforce does not reduce the potential sensitivity of the material, only the resources available for detection and response.

The information in question

The sole description of exposed material supplied by the facts is “internal files exfiltrated in ransomware attack.” No inventory of file types, no count of records, and no confirmation of personal identifiers have been published. Organisations that operate medical spas commonly store patient intake forms, treatment notes, consent documents, billing information, employee records, and internal correspondence. Whether any of those categories were among the files Medusa claims to hold is unconfirmed. Until a more detailed disclosure appears—either from the organisation or from a verified sample released by the group—the exact contents remain unknown. Readers should therefore avoid assuming that specific categories of data were or were not involved.

What's at stake

For individuals who have visited Glow Medi Spa, the principal risk is the possible exposure of personal and health-related information. Even limited internal files can contain names, addresses, phone numbers, email addresses, dates of birth, or notes about medical or aesthetic procedures. Such data can be used for targeted phishing, identity fraud, or social-engineering attempts that reference a real medical-spa relationship. Because the number of affected people is unknown, it is impossible to quantify how many clients or staff may face these risks; the prudent assumption is that anyone who has shared information with the organisation should treat the claim seriously until more is known.

For the organisation itself, the stakes include regulatory scrutiny under Canadian privacy statutes, potential notification obligations, reputational damage among a clientele that values discretion, and the operational cost of investigating and containing an incident whose full scope is still unclear. Small clinics often lack dedicated security teams, so recovery can divert limited staff time and budget. None of these consequences has been confirmed as having materialised; they remain the ordinary consequences that follow a credible ransomware claim against a healthcare-adjacent business.

Were you affected?

If you have been a client or employee of Glow Medi Spa, begin by monitoring financial and medical accounts for unexpected activity and treat unsolicited messages that reference the spa with caution. Change passwords for any accounts that may have reused credentials associated with the organisation, and enable multi-factor authentication where available. Consider placing a fraud alert with credit-reporting agencies if you believe sensitive identifiers were shared. Because the precise data involved remains unconfirmed, these steps are precautionary rather than responses to a verified leak of your personal file. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets; such a scan will not confirm or deny involvement in this specific incident, but it can surface earlier exposures that warrant attention. Stay alert for any official notice from Glow Medi Spa itself, as that remains the most reliable source of confirmation once further details emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.