Heras Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized industrial suppliers across Europe, using data theft and public leak-site listings as leverage even when the full scope of an intrusion remains unclear. In this environment, the appearance of a specialist manufacturer on a known extortion site is a signal worth examining carefully, both for the organisation involved and for anyone whose details may have been held in its systems.

On 20 May 2024, the ransomware group medusa listed Heras, a United Kingdom-based supplier of perimeter-protection solutions, claiming to have exfiltrated internal files. Public reporting states that the volume of data involved is 393.14 GB. The number of people affected has not been disclosed, and independent confirmation of the claim has not been published. The incident therefore sits in the common but still consequential category of ransomware-driven data-exfiltration events whose precise impact is still being assessed.

Breaking down the breach

According to the available record, Heras was listed by the medusa ransomware group on 20 May 2024. The group asserts that it obtained internal files during a ransomware attack and that the total volume of material amounts to 393.14 GB. No further technical detail—such as the initial access vector, the duration of the intrusion, or whether encryption was also deployed—has been made public. The number of individuals whose information may be contained in the files is listed as unknown. Because the sole source of the allegation is the group’s own leak-site claim, the facts of the compromise remain unverified by independent reporting at the time of writing.

Who is medusa?

Medusa is a ransomware operation that has been active for several years and is widely documented as employing a double-extortion model: after gaining access to a network, operators exfiltrate data and then threaten to publish it on a dedicated leak site if a ransom is not paid. The group typically advertises victims with brief descriptions of the stolen material and, in some cases, sample files. Public analyses of prior medusa campaigns show a preference for mid-market organisations across manufacturing, professional services and infrastructure-related sectors. The listing of Heras follows this established pattern; any specific assertions the group has made about the content or value of Heras’s files should be treated as claims rather than confirmed findings.

Who is Heras?

Heras, founded in 1952, designs, manufactures, installs and services permanent and temporary perimeter-protection systems for customers in business, community and industrial settings. Its United Kingdom corporate office is located in Doncaster, South Yorkshire, and the organisation is reported to employ six people at that site. Companies of this type routinely hold commercial contracts, site plans, employee records, supplier details and technical documentation related to security installations. A breach affecting such an organisation therefore carries potential consequences both for its own operations and for the clients whose premises or projects may be referenced in internal files.

The information in question

The public record states only that “internal files” were exfiltrated and that the total volume is 393.14 GB. No inventory of specific data categories—such as personal identifiers, financial records, customer contracts or technical drawings—has been released. Organisations that supply perimeter-protection solutions typically maintain employee and contractor information, commercial agreements, project documentation and correspondence with clients. Whether any of those categories are present in the material claimed by medusa remains unconfirmed. Readers should therefore treat the precise contents as undisclosed.

Why it matters

Even when the exact data types are unknown, the exfiltration of hundreds of gigabytes of internal material creates concrete risks. Individuals whose contact details, employment records or project involvement appear in the files could face phishing, social-engineering or identity-related misuse if the material is later published or sold. For Heras itself, the loss of proprietary technical or commercial information may affect ongoing contracts, competitive position and regulatory obligations under data-protection law. Clients who rely on Heras for physical security infrastructure may also need to reassess whether any of their own site or operational details have been exposed. Because the number of affected people is unknown, the full human and organisational impact cannot yet be quantified, but the volume alone indicates a non-trivial exposure.

Were you affected?

If you have worked for, contracted with, or supplied Heras, or if you have had personal or commercial dealings that would place your information in the company’s systems, treat the possibility of exposure as real until more detail emerges. Monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and be alert to unsolicited messages that reference perimeter-security projects or Heras itself. You can also run a free exposure scan of your email address against known breach data sets to check whether your details have already appeared in previously published collections. Official notifications from Heras or from relevant data-protection authorities, if and when they are issued, should be regarded as the authoritative source of further guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.