Thunder Bay Counselling Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Thunder Bay Counselling was listed by the Medusa ransomware group on December 13, 2025 after internal files were exfiltrated in a ransomware attack. The number of people affected has not been disclosed; anyone who may have shared personal information with the organization should review their accounts and monitor for unusual activity.
Breaking down the breach
The only confirmed detail is the December 13 listing on the group’s leak site. No information has been released about when the intrusion occurred, how long the attackers had access, or the volume of data taken. The organization has not issued a public statement confirming or disputing the claim, and no regulatory filings or law-enforcement notices have been referenced in available records.
Inside medusa
Medusa is a ransomware operation that follows a double-extortion model: it encrypts systems and also removes copies of files before demanding payment. When victims refuse or negotiations fail, the group posts file samples or directory listings on its leak site to increase pressure. This pattern has been documented across multiple incidents involving other organizations in recent years. In the present case the group claims Thunder Bay Counselling appears on that site; no independent verification of the data’s authenticity or scope has been made public.
About Thunder Bay Counselling
Thunder Bay Counselling provides personal and workplace counselling, psychotherapy, education, and support services to individuals, families, and businesses in the Thunder Bay area. Its work addresses mental health, substance use, and workplace challenges, with an emphasis on accessible care and community inclusion. Organizations of this type routinely collect and store sensitive personal information, including clinical notes, assessment records, and contact details for clients and staff.
The information in question
The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific file types, client records, or employee data has been released. While counselling services typically hold clinical notes, appointment histories, insurance information, and limited financial details, the exact contents of the exfiltrated material remain unconfirmed.
The real-world impact
Exposure of internal files from a counselling service can create privacy risks for clients whose mental-health or substance-use records may be involved. Individuals could face stigma, employment concerns, or unwanted contact if their information circulates. The organization itself may incur costs for investigation, legal compliance, and system restoration, though the scale of those costs is not yet known.
What to do if you're exposed
Anyone who receives notification from Thunder Bay Counselling or who suspects their information may be involved should monitor bank and insurance statements for unusual activity and consider placing a fraud alert with credit-reporting agencies. Changing passwords for any linked accounts and enabling multi-factor authentication are immediate, low-cost steps. Readers can also run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
MRC de Maskinongé - district Listed by medusa Ransomware GroupLeprohon Listed by medusa Ransomware GroupProsecuting Attorneys' Council of Georgia Listed by medusa Ransomware GroupTown of North Providence Rhode Island corporate office Listed by medusa Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Thunder Bay Counselling Listed by medusa Ransomware Group →
Publicly posted by medusa — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.