Sampoerna Agro Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Sampoerna Agro was listed by the Medusa ransomware group on December 13, 2025, with internal files reported as exfiltrated. Individuals connected to the company should check whether their data has been exposed and take protective steps.
What happened
According to the available record, the Medusa group listed Sampoerna Agro on its leak site on December 13, 2025. The only technical detail provided is that internal files were allegedly exfiltrated during a ransomware attack. The number of people whose information may be involved remains unknown, and no further information on the volume of data, the duration of unauthorized access, or the encryption status of systems has been made public.
Inside medusa
Medusa is a ransomware operation that follows the double-extortion model now common among such groups: data is copied before encryption, and the threat actors then use a public leak site to pressure victims. The group’s listings function as unverified claims until corroborated by the affected organization or independent investigation. Medusa has previously appeared in reporting on incidents across multiple industries, though specific tactics, infrastructure, or prior victims connected to this case have not been confirmed beyond the December 13 listing.
About Sampoerna Agro
PT Sampoerna Agro Tbk, founded in 1993 and headquartered in South Sumatra with its corporate office in Jakarta, produces crude palm oil, palm kernel, and related products, along with germinated palm seeds. The company employs between 5,000 and 10,000 people. Organizations of this scale maintain records on plantation operations, processing facilities, supply contracts, and workforce administration across geographically dispersed sites in Indonesia’s palm-oil sector.
What data was at risk
The only confirmed detail is that internal files were removed. The precise categories of information contained in those files have not been disclosed. Companies in this sector routinely store employee records, financial and procurement data, production logs, and documentation related to land use and regulatory compliance; whether any of these categories were among the exfiltrated material cannot be verified from current public information.
The real-world impact
Exposure of internal operational files can create downstream effects for both the company and individuals whose details appear in those records. For employees, risks may include misuse of personal identifiers or employment information. For the organization, the combination of stolen files and any resulting operational disruption can affect contract negotiations, regulatory reporting, and day-to-day processing activities. At present, the scale of these potential consequences remains undetermined because the contents of the files and the number of individuals involved have not been established.
If your data was in this claimed breach
Individuals who believe their information may have been held by Sampoerna Agro should monitor their financial and employment-related accounts for unusual activity and consider placing fraud alerts with credit agencies where available. Changing passwords for any associated online services and enabling multi-factor authentication remain basic protective steps. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information in other incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Callipo Group Listed by medusa Ransomware GroupPT Kalimantan Prima Persada Listed by medusa Ransomware GroupAlissa Group Listed by medusa Ransomware GroupWhite Coffee Corporation Listed by medusa Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Sampoerna Agro Listed by medusa Ransomware Group →
Publicly posted by medusa — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.