LGB Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a company that makes the chains, sprockets and precision parts used in cars and motorcycles appears on a ransomware group's leak site, the people most directly affected are often employees, suppliers and business partners whose internal records may have been taken. For those individuals the practical stakes are straightforward: personal and work-related information that was never meant to leave the organisation could now sit in the hands of criminals who specialise in pressure and resale.

On 3 October 2025 the ransomware group known as medusa publicly listed LGB, an Indian automotive-components manufacturer, claiming it had exfiltrated internal files. The number of people affected remains unknown, and the precise contents of the stolen material have not been independently confirmed. What follows is a careful account of what is known, what is claimed, and what those who may be involved can usefully do next.

What happened

Public reporting states that LGB was listed by the medusa ransomware group on 3 October 2025. According to the listing, internal files were exfiltrated in a ransomware attack. No further technical details—such as the initial access method, the exact date of intrusion, the volume of data taken, or any ransom demand—have been disclosed in the available record. The number of individuals whose information may be involved is listed as unknown. Because the only public assertion of the breach comes from the group's own leak-site claim, the incident should be treated as an unverified allegation until the company or independent investigators state it.

The group behind it: medusa

Medusa is a well-documented ransomware operation that follows the now-common double-extortion model: encrypting systems while simultaneously stealing data and threatening to publish it if payment is not made. The group maintains a public leak site on which it names victims, posts sample files and, in many cases, eventually dumps larger archives. Like other ransomware crews of this type, medusa typically gains entry through phishing, compromised remote-access credentials or unpatched internet-facing services, then moves laterally to locate high-value file shares and databases before deploying encryption. Its prior listings have included manufacturers, professional-services firms and public-sector entities across several continents. In the present case the group claims to have taken internal files from LGB; no independent verification of that claim has been published.

Who is LGB?

LGB is an Indian manufacturer of automotive chains, sprockets, chain tensioners and related precision components marketed under the brand name ROLON. Founded in 1937 as a transport operator, the company later became the first Indian firm to supply timing chains to four-wheeler original-equipment manufacturers and is described as the largest exporter of timing chains from India to the United States. It also holds a leading position as an OEM supplier of two-wheeler drive chains in both the original-equipment and replacement markets, and produces fine-blanked products and precision-machined gears and parts. Organisations of this kind typically maintain extensive records of employees, suppliers, customers, production schedules, quality data and commercial contracts. A breach of such records therefore carries consequences that extend beyond the company itself to the people and businesses whose details appear in those files.

What was likely exposed

The only data type named in the public record is “internal files exfiltrated in a ransomware attack.” No inventory of specific document categories, file counts or personal-data fields has been released. Companies in the automotive-components sector commonly hold employee personnel files, payroll and benefits information, supplier and customer contact lists, engineering drawings, quality-control records, shipping and logistics data, and commercial correspondence. Whether any or all of those categories were among the material medusa claims to have taken remains unconfirmed. Until a fuller disclosure appears, the exact contents of the alleged exfiltration should be regarded as unknown.

Why it matters

For individuals whose information may have been included, the concrete risks include targeted phishing that references real internal details, identity-related fraud if personal identifiers were present, and possible social-engineering attempts against colleagues or family members. For LGB itself, the exposure of internal files can disrupt supplier relationships, reveal commercial terms to competitors, and create regulatory or contractual obligations to notify affected parties. Even when encryption is reversed or systems are restored, the mere fact that data left the organisation creates lasting uncertainty about how that information may later be used. Because the scale of the incident is still undisclosed, the full extent of these risks cannot yet be measured.

If your data was in this claimed breach

If you are a current or former employee, supplier or business partner of LGB, treat any unexpected messages that reference the company or its products with caution. Change passwords on accounts that may have been reused, enable multi-factor authentication wherever it is available, and monitor financial and credit activity for unusual behaviour. Keep records of any suspicious contact that appears to draw on internal knowledge. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets; such a check provides an early indication of wider exposure even when the precise contents of this particular incident remain unconfirmed.

AICompiled with AI assistance from public sources and published under our editorial standards.