Leprohon (Image !) Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized firms across construction and related trades, using data theft as leverage even when systems are restored. In this climate, listings on criminal leak sites have become a common way for attackers to pressure victims and signal that internal material has left the network.

On 9 October 2025, the ransomware group known as medusa publicly listed Leprohon (Image !), a Canadian construction company, claiming it had exfiltrated internal files. The number of people affected remains unknown, and public detail on the precise scope is limited. The listing itself is an unverified claim by the group; what is confirmed is only that the organisation appeared on the site in connection with a ransomware attack involving data theft.

Inside the incident

According to the available record, Leprohon (Image !) was listed by the medusa ransomware group on 9 October 2025. The group asserts that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access method, the duration of the intrusion, the volume of data taken, or any ransom demand—have been disclosed in the public summary. The number of individuals whose information may have been involved is listed as unknown. Beyond the leak-site claim and the statement that internal files were removed, the incident’s operational specifics remain unconfirmed.

Who is medusa?

Medusa is a well-documented ransomware operation that has been active for several years. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also stealing data, then threatening to publish the stolen material on a dedicated leak site if payment is not made. The group has previously listed organisations across multiple sectors, including manufacturing, professional services and construction-related firms. Its public posts usually contain sample files or directories intended to demonstrate possession of data. In this case, the listing of Leprohon is presented solely as the group’s claim; no independent confirmation of the full contents or authenticity of any samples has been supplied in the facts available.

About Leprohon (Image !)

Leprohon Inc. operates in the commercial and residential construction industry. Public records place the company in Sherbrooke, Quebec, Canada, with a headquarters address at 6171 Boulevard Bourque, Sherbrooke, Québec, J1N 1H2. It is described as employing between 250 and 499 people—elsewhere noted as 351 employees—and generating annual revenue in the range of 25 million to 50 million dollars. Construction firms of this size routinely manage project documentation, client contracts, supplier records, payroll and employee information, site plans, and financial data. A breach at such an organisation can therefore affect not only staff but also clients, subcontractors and partners whose details appear in internal systems.

What was likely exposed

The only data type named in the available facts is “internal files exfiltrated in ransomware attack.” No inventory of specific categories—such as employee records, customer contracts, financial statements or project files—has been published. Organisations in commercial and residential construction typically hold personnel data (names, contact details, banking information for payroll), client and supplier correspondence, bid documents, architectural or engineering drawings, invoices and insurance records. Because the exact contents remain undisclosed, it is not possible to state with certainty which of these, if any, were among the files taken. The claim of exfiltration stands as an assertion by the threat actor rather than a verified catalogue.

The real-world impact

For individuals whose information may have been included, the principal risks are opportunistic misuse of personal or financial details—identity fraud, targeted phishing, or social-engineering attempts that reference genuine project or employment information. Employees and contractors could face inconvenience if payroll or benefits data were involved. For the company itself, the consequences can include operational disruption, legal and regulatory notification obligations under Canadian privacy law, potential contractual disputes with clients, and reputational damage among partners who rely on the firm’s handling of sensitive project material. Because the scale of the exposure is unknown, the precise number of people or projects affected cannot be quantified from public information.

What to do if you're exposed

Anyone who has worked for, contracted with, or supplied Leprohon should treat the listing as a prompt to review their own exposure. Monitor bank and credit accounts for unexpected activity, enable multi-factor authentication on email and financial services, and be alert to unsolicited messages that reference construction projects or employment details. Consider placing a fraud alert with Canadian credit bureaus if personal identifiers may have been involved. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan provides an additional, independent signal of whether personal information has circulated beyond this single incident.

AICompiled with AI assistance from public sources and published under our editorial standards.