Sonda (Duplicate with update) Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target technology and managed-service providers, treating them as high-value gateways to broader client ecosystems. In this landscape, claims of repeated intrusion and large-scale data publication are used both to pressure victims and to advertise the attackers’ reach. One such claim, dated May 2023, involves the Chilean IT firm Sonda and the Medusa ransomware group.

According to a listing attributed to Medusa, Sonda was compromised more than once, with internal files said to have been exfiltrated and more than 4 TB of data published for public download. The number of people affected remains unknown, and independent confirmation of the full scope is limited. The incident matters because an IT services company sits at the intersection of many organisations’ systems and data, so any verified exposure can carry consequences well beyond a single corporate network.

Breaking down the breach

Public reporting places the listing on 5 May 2023. The group’s own statement asserts that it first hacked Sonda “last month,” found the network still vulnerable, and regained access on 4 May 2023. It further claims that more than 4 TB of data was published that day on a Telegram channel, accompanied by a proof image, and that anyone could access and download the material. The only data category named in available records is “internal files exfiltrated in a ransomware attack.” No independent tally of affected individuals, no confirmed list of file types, and no verified technical details of the intrusion method have been released in the material provided. The group’s recommendation that companies stop using Sonda IT support is presented as part of its public messaging rather than as an established finding.

Inside medusa

Medusa is a ransomware operation that has been publicly documented since at least 2021. Like other groups in this category, it typically combines network intrusion, data theft, and encryption, then threatens to publish stolen material on a dedicated leak site or secondary channels if a ransom is not paid. Medusa has been observed listing organisations across multiple sectors and geographies, often posting sample files or volume claims to demonstrate access. Its public communications frequently emphasise the scale of exfiltrated data and urge third parties to avoid the victim’s services. In the present case, the listing of Sonda and the assertions about repeated access and a 4 TB Telegram release should be treated as claims made by the group; they have not been independently verified in the facts available here.

Who is Sonda (Duplicate with update)?

Sonda is described in the group’s statement as a Chilean multinational IT company headquartered in Santiago. Organisations of this type commonly supply software, infrastructure, cloud, and managed IT services to corporate and public-sector clients across Latin America and beyond. Because such firms often hold credentials, configuration data, source code, internal documentation, and sometimes customer or employee records in the course of delivering support, a breach can affect both the provider and the organisations that rely on it. The consequential nature of an incident here stems less from any single data field and more from the trust placed in an IT partner that may have privileged access to many other networks.

The information in question

The only category explicitly named is internal files said to have been exfiltrated during a ransomware attack. The group claims the published volume exceeds 4 TB and is freely downloadable. Exact contents—whether source repositories, internal emails, client configurations, employee data, or other materials—are not itemised in the available record. Companies in the IT-services sector typically store project files, system documentation, authentication materials, and business records; any of these could be sensitive if exposed. Until fuller inventories are confirmed by the organisation or by independent investigators, the precise nature of what was taken remains unconfirmed beyond the group’s broad assertion of internal files.

The real-world impact

For individuals whose information may appear in internal files—employees, contractors, or clients—the practical risks include targeted phishing, credential stuffing, or social-engineering attempts that reference genuine internal details. For client organisations that use Sonda’s services, the concern is whether any shared credentials, network diagrams, or support artefacts were among the material claimed to have been published. For Sonda itself, the listing creates reputational pressure and the operational burden of investigating residual access, notifying partners where required, and restoring confidence. Because the number of people affected is unknown and the exact data types are not fully disclosed, the scale of personal harm cannot be quantified from public facts alone; the prudent assumption is that anyone whose data resided in the company’s internal systems should treat the claim seriously until more is known.

Were you affected?

If you are an employee, contractor, or customer of Sonda or of organisations that rely on its IT support, monitor accounts for unusual activity, enable multi-factor authentication where available, and treat unsolicited messages that reference internal projects or colleagues with caution. Consider changing passwords that may have been stored or reused in work contexts. You can also run a free exposure scan of your email address to check whether it has appeared in known breach data sets. Official notifications, if any are issued by the company or by regulators, remain the most reliable source of personalised guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.