Prosolit Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by stealing data and threatening public release, a pattern that has become a routine feature of the current threat landscape. In this environment, even mid-sized technology providers can find themselves listed on leak sites, raising questions for clients and partners about what may have been taken.

On 7 September 2024, the ransomware group known as medusa listed Prosolit, a Belgian IT services firm, claiming to have exfiltrated internal files. Public detail remains limited: the number of people affected is unknown, and the precise contents of the material have not been independently confirmed. The listing itself is a claim by the group rather than a verified disclosure by the company.

Inside the incident

According to the available record, medusa claimed responsibility for a ransomware attack against Prosolit and listed the organisation on its leak site. The group stated that internal files had been exfiltrated and that the total volume of data involved was 13.07 GB. The date associated with the public listing is 7 September 2024. No further operational details—such as the initial access method, the duration of the intrusion, or whether systems were encrypted—have been disclosed in the public facts. The number of individuals whose information may have been involved is unknown. Because the information originates from a threat-actor listing, it should be treated as an unverified claim pending any confirmation from Prosolit or independent investigators.

Who is medusa?

Medusa is a ransomware operation that has been active in recent years and is known for a double-extortion model: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. The group typically maintains a dark-web leak site where it posts victim names, sample files, and countdown timers. Public reporting has associated medusa with attacks on organisations across multiple sectors and countries; the group often claims to have taken large volumes of internal documents, databases, and credentials. Its listings are marketing and pressure tactics as much as technical disclosures, so claims about any specific victim—including the volume or sensitivity of data—remain assertions by the attackers until corroborated. No additional statements by medusa about Prosolit beyond the listing and the 13.07 GB figure appear in the provided facts.

About Prosolit

Prosolit is an IT services company founded in 2004 and headquartered at Av. Roi Albert 157/2, 5300 Andenne, Belgium. It offers site development, e-commerce solutions, management software, security software, and related information-technology services. Firms of this type commonly hold source code, client project files, configuration data, internal administrative records, and sometimes customer or partner contact details. A breach at a provider that supplies development and security tools can have secondary effects: clients may need to assess whether their own environments or intellectual property were stored on the vendor’s systems. The public facts do not indicate whether any client systems were directly compromised; they only record the listing of Prosolit itself.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack and that the claimed volume is 13.07 GB. Exact data types beyond the description “internal files” are not disclosed. Organisations that develop websites, e-commerce platforms, management software and security tools typically store source repositories, project documentation, internal emails, employee records, client contracts, and system credentials. Whether any of those categories were present in the 13.07 GB archive remains unconfirmed. Readers should therefore treat the exposure as limited to the group’s claim of internal files rather than as a verified inventory of personal or commercial data.

The real-world impact

For individuals whose information may have been among the internal files, the practical risks include potential misuse of contact details, credentials, or personal identifiers if such material was present. For Prosolit, the listing creates reputational pressure, possible regulatory notification obligations under European data-protection rules, and the need to investigate and contain any residual access. Clients of the firm may face secondary concerns: if project files or credentials were stored with Prosolit, those clients may need to rotate secrets, review access logs, or reassess third-party risk. Because the number of people affected is unknown and the precise contents unconfirmed, the scale of individual harm cannot be quantified from public information alone. The incident nonetheless illustrates how ransomware groups target service providers whose data holdings can amplify impact beyond a single organisation.

What to do if you're exposed

If you have a relationship with Prosolit—as an employee, client or partner—consider the following practical steps:

• Monitor official statements from Prosolit for any confirmation of the incident and guidance on affected data.
• Change passwords and enable multi-factor authentication on accounts that may have been linked to Prosolit systems or shared credentials.
• Review bank and credit activity for unusual transactions and place fraud alerts if personal identifiers could have been involved.
• Be alert for phishing that references the breach or pretends to offer remediation help.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in other incidents.

These measures are precautionary; they do not assume that any particular individual’s data was present in the claimed 13.07 GB archive. Public detail remains limited, and further clarity will depend on official disclosures.

AICompiled with AI assistance from public sources and published under our editorial standards.