R&W Engineering Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized professional services firms, treating internal engineering files and operational data as leverage for extortion. In this environment, listings on criminal leak sites have become a common way for attackers to pressure victims and advertise their reach.

On June 13, 2025, R&W Engineering was listed by the Medusa ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack and that the total volume of data claimed to have been leaked is 676.5 GB. The number of people affected remains unknown. The listing itself is a claim by the group; independent confirmation of the full scope has not been provided in the available record.

Inside the incident

According to the reported summary, R&W Engineering, an engineering company headquartered at 9615 SW Allen Blvd., Suite 107, Beaverton, OR 97005, appeared on a Medusa leak site. The facts state that internal files were exfiltrated in a ransomware attack and that the total amount of data leakage is 676.5 GB. The date associated with the public report is June 13, 2025. No further detail is given on the initial access method, the duration of the intrusion, whether systems were encrypted, or whether any ransom demand was paid. The number of individuals whose information may have been involved is listed as unknown. Beyond the volume figure and the description of “internal files,” the precise inventory of what was taken has not been disclosed in the available facts.

Who is medusa?

Medusa is a ransomware operation that has been publicly documented for several years. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems where possible while also stealing data and threatening to publish it if payment is not made. The group maintains a leak site on which it posts victim names, sample files, and sometimes large archives to increase pressure. Medusa has been associated with attacks across multiple sectors, including professional services, manufacturing, and technology-adjacent firms. Its operators have historically used common initial-access techniques such as phishing, exploitation of exposed remote services, or compromised credentials, though the specific vector used against any given victim is often not publicly confirmed. In this case, the group’s listing of R&W Engineering constitutes a claim that data was taken and would be released; the facts do not independently verify every assertion on the leak site.

Who is R&W Engineering?

R&W Engineering is an engineering company based in Beaverton, Oregon. Firms of this type typically provide design, consulting, and technical services for infrastructure, industrial, or commercial projects. Such organisations routinely hold project documentation, technical drawings, client correspondence, contracts, employee records, and internal operational files. Because engineering work often involves sensitive client information, proprietary designs, and regulatory or safety-related materials, a breach can affect not only the company itself but also its customers and partners. The public record does not describe R&W Engineering’s exact client base or project portfolio beyond identifying it as an engineering firm at the stated address.

What was likely exposed

The facts name the exposed material as “internal files exfiltrated in a ransomware attack” and give a total volume of 676.5 GB. No further breakdown of file types, databases, or personal data categories is provided. Organisations of this kind commonly store engineering drawings, project specifications, emails, financial records, human-resources documents, and client-related materials. Whether any of those categories were present in the 676.5 GB archive, and whether personal identifiers of employees or clients were included, remains unconfirmed. The number of people affected is explicitly unknown. Readers should treat any specific claims about the contents of the files as unverified unless corroborated by the company or by independent forensic reporting.

The real-world impact

For individuals whose information may have been among the internal files, the practical risks include potential misuse of contact details, employment data, or other personal records if such material was present. For the organisation, the consequences can include operational disruption, contractual obligations to notify clients, regulatory scrutiny depending on the nature of any personal data involved, and reputational harm. Because the exact contents and the number of affected people are undisclosed, the scale of individual harm cannot be quantified from the public facts alone. Even when personal data is limited, the release of proprietary engineering files can create competitive or security concerns for clients whose projects were documented in the stolen material. The listing by a ransomware group also signals that the data may already be circulating among other criminal actors, increasing the window of risk.

If your data was in this claimed breach

If you have a past or present relationship with R&W Engineering—as an employee, contractor, or client—monitor accounts and communications for unusual activity. Change passwords on any accounts that may have shared credentials with work systems, enable multi-factor authentication where available, and remain alert to phishing attempts that reference the company or engineering projects. Because the number of people affected and the precise data types are unknown, treat any unsolicited contact claiming to relate to this incident with caution. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach datasets; such checks provide an additional, independent signal of whether your details have surfaced elsewhere.

AICompiled with AI assistance from public sources and published under our editorial standards.