Maxeon Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 18 November 2024, the solar-energy company Maxeon appeared on a ransomware group’s leak site, raising the practical possibility that internal company files had been taken and could later surface. For employees, partners, suppliers and anyone whose details sit inside those systems, the immediate concern is straightforward: whether personal or business information has left Maxeon’s control and what that could mean for privacy, fraud risk or contractual obligations.

Public detail remains limited. The listing itself is a claim by the group known as medusa; the number of people affected is unknown, and the precise contents of the files have not been independently confirmed. What is known is that the incident is described as a ransomware attack involving the exfiltration of internal files.

Inside the incident

According to the available record, Maxeon was listed by the medusa ransomware group on 18 November 2024. The report states that internal files were exfiltrated in a ransomware attack. No further operational details—such as the initial access method, the duration of the intrusion, the volume of data taken, or any ransom demand—have been disclosed in the public summary. The number of individuals whose information may be involved is listed as unknown. Because the primary source of the claim is the group’s own leak-site posting, the incident should be treated as an unverified assertion until Maxeon or independent investigators provide confirmation.

The group behind it: medusa

Medusa is a ransomware operation that has been active in recent years and is publicly documented as using a double-extortion model: encrypting systems while also copying data and threatening to publish it if payment is not made. The group typically posts victim names on a dedicated leak site, sometimes releasing sample files to pressure organisations. Its tactics generally include phishing or exploitation of remote-access services, followed by lateral movement, data theft and deployment of ransomware. Public reporting has linked medusa to attacks across multiple sectors, though each listing remains a claim by the group rather than verified fact. In this case, the facts state only that Maxeon was listed and that internal files were described as exfiltrated; no additional statements attributed to medusa about this specific victim appear in the record.

About Maxeon

Maxeon is a solar-energy innovation company that designs, manufactures and markets advanced solar panels and related solutions worldwide under the Maxeon and SunPower brands. Its corporate office is located at Marina Bay Financial Centre, 8 Marina Boulevard, Singapore, and the organisation employs approximately 3,888 people. Companies of this type typically maintain extensive operational, financial, employee and partner records, as well as technical data related to product design, supply chains and customer installations. A ransomware incident at such an organisation therefore carries potential consequences not only for internal operations but also for the wider network of employees, contractors, distributors and end customers who rely on the company’s systems and data handling.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No further breakdown—such as employee records, customer lists, financial documents, intellectual property or technical schematics—has been publicly confirmed. Organisations in the solar manufacturing and energy sector commonly hold personnel data, supplier contracts, research and development materials, and commercial correspondence. Because the exact contents remain undisclosed, it is not possible to state with certainty which categories of information were taken. Readers should treat any specific claims about data types beyond the general description of internal files as unconfirmed.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include potential misuse of personal details for phishing, identity fraud or social-engineering attempts. Employees and contractors could face targeted outreach that appears legitimate because it draws on real internal context. For Maxeon itself, the stakes involve possible disruption to manufacturing and supply-chain operations, reputational damage, regulatory scrutiny under data-protection rules, and the cost of investigation and remediation. Partners and customers may also need to reassess the security of shared information. None of these outcomes is guaranteed; they represent the ordinary range of consequences that follow ransomware incidents involving data exfiltration when the precise scope remains unknown.

Were you affected?

If you are a current or former Maxeon employee, contractor, supplier or customer, treat the listing as a prompt for caution rather than confirmed exposure. Monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and be sceptical of unexpected messages that reference Maxeon or solar-industry matters. Consider changing passwords for any accounts that may have been used in connection with the company. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Official updates, if any, will come from Maxeon or relevant authorities; until then, the public record remains limited to the group’s claim and the summary details above.

AICompiled with AI assistance from public sources and published under our editorial standards.