Sonda Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 03, 2023, the Chilean IT multinational Sonda was listed by the medusa ransomware group, which claimed to have carried out a ransomware attack involving the exfiltration of internal files. Public reporting does not state how many people were affected, nor does it confirm the full scope of systems involved. What is known so far rests on the group's leak-site claim and the limited description that internal files were taken.

For an organisation of Sonda's size and regional role, even an unconfirmed listing matters: IT providers often sit close to client systems, employee records, and operational data. Until more detail is verified, the concrete picture remains partial.

Inside the incident

According to the available record, Sonda was listed by medusa on or around April 03, 2023. The reported description characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. No public figure has been given for the number of people affected. Timing of the intrusion, the initial access method, the duration of any dwell time, and whether systems were encrypted in addition to data theft are not disclosed in the facts at hand.

The listing itself is a claim published by the threat actor. Independent confirmation of the full contents of any stolen archive, or of negotiations between the parties, has not been supplied in the material used for this account. Readers should treat the group's assertion as an allegation pending further verification by the company or by independent investigators.

Who is medusa?

Medusa is a ransomware operation that has been publicly documented for double-extortion tactics: operators encrypt victim environments and simultaneously exfiltrate data, then threaten to publish material on a leak site if demands are not met. The group typically advertises victims on that site with short descriptions and, in some cases, sample files, as a form of pressure. Prior public reporting has associated medusa with attacks across multiple sectors and regions; the group is known for naming corporate and institutional targets rather than operating solely as a pure encryptor.

None of that general pattern proves the specific contents or impact of any single listing. In this case, the only attribution in the record is medusa's claim that Sonda was hit and that internal files were taken. No additional statements attributed to the group about this victim—such as file counts, ransom figures, or deadlines—are included in the facts provided here.

About Sonda

Sonda is a Chilean multinational information-technology company headquartered in Santiago. Public descriptions cast it as a major digital-transformation provider in Latin America, with more than 13,000 employees, operations in 11 countries, and solutions deployed in more than 3,000 cities. It is widely regarded as one of the largest IT firms in the region.

Organisations of this type typically design, integrate, and support systems for governments, enterprises, and other institutions. That work can involve access to client environments, project documentation, employee and contractor information, and operational tooling. A breach claim against such a provider is consequential not only for the company's own workforce but potentially for the wider set of organisations that rely on its services—though any client impact in this incident remains unconfirmed in the public record.

What was likely exposed

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. No inventory of file types, no count of records, and no confirmation of customer, employee, or financial datasets have been published in the material available for this article. Exact contents are therefore unconfirmed.

Companies in Sonda's position commonly hold categories of data such as the following; these are industry norms, not a verified list from this incident:

• Internal corporate documents, policies, and project files
• Employee and contractor records, including contact and HR-related information
• Technical documentation, configurations, and support materials
• Commercial and client-related correspondence or contracts, depending on the systems involved

Until Sonda or a competent authority publishes a confirmed breakdown, no specific personal or client data types should be treated as established fact for this event.

What's at stake

For individuals whose information may have been among internal files, risks are practical rather than abstract: possible misuse of contact details, targeted phishing that references real internal context, or credential stuffing if any authentication material was present. Because the scale and exact data types are unknown, the severity for any one person cannot be ranked from public facts alone.

For the organisation, a ransomware-related exfiltration claim can mean operational disruption, regulatory and contractual scrutiny, and erosion of trust among employees and clients across the countries where it operates. IT providers are often held to elevated expectations precisely because they handle sensitive environments for others. None of that equates to a finding of fault; it simply describes why the stakes are higher when such a firm appears on a leak site.

If your data was in this claimed breach

If you are a current or former Sonda employee, contractor, or client contact and you are concerned you may have been affected, take measured steps. Monitor accounts for unusual login attempts and enable multi-factor authentication where it is available. Treat unexpected messages that reference internal projects or colleagues with caution, and verify them through official channels. Consider placing fraud alerts with relevant credit or identity services if you believe sensitive personal identifiers could have been involved—bearing in mind that such involvement has not been confirmed here. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach datasets. Official updates, if any, should come from Sonda or from regulators; rely on those rather than on unverified reposts of leak-site claims.

AICompiled with AI assistance from public sources and published under our editorial standards.