Gujarat Mineral Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target industrial and state-linked organisations, using data theft alongside encryption to increase pressure. In this environment, listings on criminal leak sites have become a common way for attackers to signal that they hold an organisation’s files and intend to publish them if demands are unmet.

On 24 March 2023, Gujarat Mineral Development Corporation Limited, known as Gujarat Mineral or GMDC, was listed by the Medusa ransomware group. Public detail on the incident remains limited. The listing itself is a claim by the group that internal files were taken in a ransomware attack; the number of people affected is unknown, and independent confirmation of the full scope has not been published in the material available here.

What happened

According to the reported information, Gujarat Mineral was listed by the Medusa ransomware group on 24 March 2023. The group’s claim is that internal files were exfiltrated in a ransomware attack. No public figure has been given for the volume of data, the precise date the intrusion began, or the technical method used to gain access. The number of individuals whose information may be involved is unknown. Beyond the leak-site listing and the description of internal files taken, further operational detail has not been disclosed in the available record.

Who is medusa?

Medusa is a ransomware operation that has been active in recent years and is widely documented in public cybersecurity reporting. Like many contemporary ransomware groups, it typically follows a double-extortion model: operators encrypt systems and also copy data, then threaten to publish the stolen material on a dedicated leak site if a ransom is not paid. The group has listed organisations across multiple sectors and countries. Listings on such sites are claims made by the attackers; they do not by themselves constitute independent verification that every asserted detail is accurate. In this case, Medusa’s listing of Gujarat Mineral should be read as the group’s assertion that it obtained internal files, not as a fully corroborated public forensic report.

About Gujarat Mineral

Gujarat Mineral Development Corporation Limited is a large Indian state-owned mining and brown-coal company headquartered in Ahmedabad. Founded in 1963, it works with basic energy minerals such as brown coal, base metals, and industrial minerals including bauxite and fluorspar, and it also participates in business related to oil refining. As a significant public-sector minerals enterprise, it holds operational, commercial, and administrative records typical of a major mining and energy-minerals organisation. A breach affecting such an entity matters because the organisation sits at the intersection of natural-resource extraction, state ownership, and industrial supply chains; disruption or exposure of its internal material can affect operations, commercial partners, and the people whose details appear in corporate systems.

The information in question

The available facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file categories, employee or customer records, financial documents, or other specific data types has been disclosed. Organisations of this kind commonly maintain personnel records, contractor and vendor information, operational and geological data, commercial contracts, and internal correspondence. Whether any of those categories were among the files Medusa claims to hold has not been confirmed in the public summary. Exact contents therefore remain unconfirmed; only the general description of internal files taken in a ransomware incident is on record.

What's at stake

For people whose information may appear in internal corporate files, risks include unwanted contact, phishing that uses accurate organisational context, and longer-term misuse of personal or employment-related details if those details were present and later circulated. For the organisation, stakes include operational disruption from encryption, potential exposure of commercially sensitive material, regulatory and contractual obligations around data protection, and the reputational and remedial costs that follow a claimed ransomware incident. Because the scale and precise contents are undisclosed, the concrete impact on any individual cannot be stated with certainty from the public facts alone. The listing nonetheless signals that internal material was, according to the attackers, removed from the organisation’s control.

If your data was in this claimed breach

If you have a past or present connection to Gujarat Mineral—as an employee, contractor, partner, or in another capacity—treat the possibility of exposure seriously even though the full contents remain unconfirmed. Practical first steps include:

• Monitor accounts and communications for unexpected messages that reference the organisation or your role with unusual urgency or requests for credentials or payments.
• Change passwords on work-related and personal accounts that may have shared credentials or recovery details, and enable multi-factor authentication where available.
• Watch financial and identity statements for unfamiliar activity and consider credit or fraud alerts if you believe sensitive personal identifiers could have been involved.
• Be cautious with unsolicited calls or emails claiming to help with “breach recovery”; verify any such contact through official channels you already trust.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach datasets, which can help you prioritise further monitoring.

Public detail on this incident is limited. Official updates, if any, would come from the organisation or competent authorities. Until more is confirmed, measured caution and basic account hygiene remain the most useful responses.

AICompiled with AI assistance from public sources and published under our editorial standards.