Novus International Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 12, 2024, Novus International appeared on a listing by the medusa ransomware group, which claimed the company as a victim of a ransomware attack involving the exfiltration of internal files. Public detail is limited on how many people may be affected, yet the claim of 151.3 GB of data taken raises practical stakes for employees, partners, and anyone whose information might sit inside those files. For ordinary people connected to the firm, the core concern is whether personal or professional details could surface and be misused.

Because the number of people affected remains unknown and the exact contents of the files have not been independently confirmed, anyone with ties to Novus International has reason to treat the listing seriously and take basic protective steps while further information is assessed.

Inside the incident

According to the available record, Novus International was listed by the medusa ransomware group on April 12, 2024. The group claims that internal files were exfiltrated during a ransomware attack and that the total volume of data involved is 151.3 GB. No public confirmation of the attack method, the precise date of intrusion, or any ransom demand has been provided in the facts. The number of people whose data may be included is listed as unknown. The listing itself is an unverified claim by the group; independent verification of the full scope has not been detailed in the public record.

What is stated is limited to the claim of internal-file exfiltration and the reported data volume. Timing of the initial compromise, any encryption of systems, and whether the company has responded publicly remain undisclosed in the given facts.

Who is medusa?

Medusa is a ransomware operation that has been publicly documented as using a double-extortion model: operators encrypt victim systems and simultaneously steal data, then threaten to publish the stolen material on a leak site if payment is not made. The group typically posts victim names and sample claims on its dedicated site to pressure organisations. Prior public reporting has associated medusa with attacks across multiple sectors, often emphasising the volume of data taken rather than technical details of the intrusion. In this case the group claims Novus International as a victim and asserts that 151.3 GB of internal files were removed; those assertions should be treated as claims unless independently confirmed.

Medusa’s public activity has generally focused on corporate targets rather than individuals, yet the data it claims to hold can still contain personal identifiers, credentials, or commercial records that later appear in secondary markets or phishing campaigns.

About Novus International

Novus International, founded in 1991, develops animal-nutrition solutions for livestock, poultry, and aquaculture. Its corporate office is located at 20 Research Park Dr, Saint Charles, Missouri, 63304, United States, and the organisation employs 871 people. Companies of this type typically maintain research data, supplier and customer records, employee information, and proprietary formulations. A breach involving internal files is consequential because the firm operates at the intersection of agriculture, animal health, and commercial supply chains; disruption or exposure of those materials can affect business continuity, intellectual property, and the privacy of staff and partners.

Even without confirmed customer-facing consumer data, the presence of internal corporate files means employees, contractors, and business contacts may find their details among the material the group claims to hold.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack and that the total amount of data leakage claimed is 151.3 GB. Specific data types beyond “internal files” are not further itemised, and the exact contents remain unconfirmed. Organisations in the animal-nutrition sector commonly hold employee records, research and development documents, supplier contracts, customer lists, financial information, and operational data. Because the public record does not name precise categories such as Social Security numbers, payment-card data, or health records, it is not possible to state with certainty which of those elements, if any, are present. Readers should therefore treat the exposure as potentially broad while recognising that the precise inventory has not been disclosed.

The real-world impact

For individuals, the practical risks include targeted phishing that references internal company details, credential stuffing if work-related passwords appear, and possible identity-related fraud if personal identifiers were stored in the files. Employees and former staff may face elevated risk of social-engineering attempts that exploit knowledge of internal processes or colleagues. Partners and suppliers could see commercial information used to craft more convincing fraud schemes.

For the organisation, the consequences can include operational disruption, potential regulatory scrutiny depending on the jurisdictions and data involved, reputational harm among customers and investors, and the cost of investigation and remediation. Because the number of people affected is unknown and the full contents unconfirmed, the scale of downstream harm cannot yet be quantified; the 151.3 GB figure simply indicates a substantial volume of material that the group claims to control.

What to do if you're exposed

If you have a current or past connection to Novus International—as an employee, contractor, supplier, or customer—consider the following practical first steps:

• Monitor financial and credit accounts for unusual activity and consider placing a fraud alert or credit freeze if personal identifiers may have been involved.
• Change passwords for work-related and personal accounts that share credentials, and enable multi-factor authentication wherever available.
• Treat unexpected emails, calls, or messages that reference company matters with heightened caution; verify requests through known official channels.
• Review any available company notifications for guidance specific to this incident.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

Public detail remains limited; continuing to watch for official updates from the company or relevant authorities is the most reliable way to learn whether additional protective measures become necessary.

AICompiled with AI assistance from public sources and published under our editorial standards.