SHAMASS.ORG Listed by medusalocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 22 April 2024 the organisation SHAMASS.ORG appeared on a listing maintained by the medusalocker ransomware group. The group claims it has taken internal files that include employee information, agreements, customer email spreadsheets and Outlook message files, and has advertised them for sale at a stated price of $50,000. For anyone whose personal or work details may sit inside those files, the practical stakes are immediate: the material could be used for targeted phishing, identity misuse or further fraud, even though the exact number of people affected remains unknown and public confirmation of the breach is limited to the group’s own claim.

Because the listing is the primary public record, ordinary people connected to SHAMASS.ORG—employees, customers or partners—have little independent verification of what was taken or how widely it has already circulated. That uncertainty itself is part of the risk.

What happened

According to the available record, SHAMASS.ORG was listed by the medusalocker ransomware group on 22 April 2024. The group states that internal files were exfiltrated during a ransomware attack. The description attached to the listing refers to employee information, agreements, customer email files in spreadsheet format and Outlook .msg files. It also names a sale price of $50,000 and notes that options for further profit from the files would be included in any deal. No independent confirmation of the intrusion, the volume of data or the precise date of the attack has been published. The number of people whose information may be involved is listed as unknown. Technical details of how the attackers gained access—whether through phishing, an unpatched system or another vector—are not disclosed in the public summary.

Inside medusalocker

Medusalocker is a ransomware operation that has been active for several years and is documented in open-source reporting as practising double extortion. In this model the group encrypts systems and simultaneously steals data, then threatens to publish or sell the stolen material if a ransom is not paid. Listings on its leak site typically include sample files or brief descriptions intended to pressure the victim and attract buyers. The group has previously targeted organisations across multiple sectors and geographies; its public posts often advertise data packages with price tags and claims about the commercial value of the material. Nothing in the present listing goes beyond the group’s own assertions about SHAMASS.ORG; those assertions have not been independently verified in the available record.

Who is SHAMASS.ORG?

Public detail about SHAMASS.ORG itself is limited. The domain suggests an organisational website, most likely belonging to a company, association or service provider that maintains internal records and customer contact lists. Organisations of this kind routinely hold employee personnel files, contractual agreements, customer email addresses and internal correspondence. A breach of such material is consequential because the data can link real people to their workplaces, financial arrangements or personal communications. Without fuller public disclosure it is not possible to describe the organisation’s exact size, sector or geographic footprint, yet the types of files named in the listing are consistent with the ordinary administrative holdings of many mid-sized entities.

What was likely exposed

The medusalocker listing names the following categories: employee information, agreements, customer email files in .xls format and Outlook .msg files. These are described as internal files exfiltrated in a ransomware attack. No further inventory—such as the number of records, the date range of the emails or the presence of financial or health data—has been released. Organisations that keep employee and customer records typically also store names, contact details, job titles, contractual terms and message histories; whether any of those additional elements are present here remains unconfirmed. The group’s claim that the package is offered for $50,000 with “options for making a profit” is simply the language of the listing and does not constitute independent evidence of the data’s contents or market value.

Why it matters

For individuals whose details may appear in the files, the concrete risks include spear-phishing that uses genuine internal language or email threads, attempts to reset accounts with harvested personal information, and the long-term possibility that the data will be resold or combined with other breaches. Employees could face workplace-related social-engineering attempts; customers could receive convincing fraudulent messages that reference real correspondence. For the organisation the exposure of internal agreements and staff data can damage trust, invite regulatory scrutiny and create ongoing operational distraction. Because the number of affected people is unknown and the full scope of the files is unconfirmed, the duration and severity of these risks cannot yet be measured precisely. The absence of independent verification also means that people cannot easily determine whether their own information is involved.

Were you affected?

If you have worked for, contracted with or been a customer of SHAMASS.ORG, treat the possibility of exposure as real until clearer information emerges. Monitor financial and email accounts for unusual activity, enable multi-factor authentication wherever it is offered, and be especially cautious of unsolicited messages that appear to come from colleagues or the organisation itself. Change passwords on any accounts that may have shared credentials with workplace systems. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan will not confirm involvement in this specific incident but can indicate whether the address is circulating more widely. Keep records of any suspicious contact and report confirmed fraud to the relevant authorities. Further public updates from SHAMASS.ORG or independent researchers, if they appear, will be the most reliable source of additional detail.

AICompiled with AI assistance from public sources and published under our editorial standards.