Travel Alberta Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

For anyone who has dealt with Travel Alberta — staff, partners, contractors, or people whose details sit in tourism databases — a ransomware group’s claim that the organisation’s internal files were taken raises immediate, practical questions. What may have left the organisation, who might see it, and what should people do next remain only partly answered in public reporting.

On 30 September 2024, Travel Alberta was listed by the medusa ransomware group. The listing asserts that internal files were exfiltrated in a ransomware attack and that the volume of data involved is 799.80 GB. The number of people affected is unknown, and public detail on the precise contents remains limited.

Breaking down the breach

Public reporting states that Travel Alberta was listed by the medusa ransomware group on 30 September 2024. According to the available summary, the group claims internal files were exfiltrated in a ransomware attack and that the total amount of data leakage is 799.80 GB. No further Reported Details on the initial intrusion method, the exact date of compromise, or whether systems were encrypted have been disclosed in the facts provided. The number of individuals whose information may be involved is listed as unknown. The organisation itself is described as a tourism marketing body founded in 2009, with a corporate office at 400-1601 9 Ave SE, Calgary, Alberta, T2G 0H4, Canada, and approximately 110 employees. Beyond the group’s leak-site listing and the stated data volume, independent verification of the full scope has not been detailed in the available record.

Inside medusa

Medusa is a well-documented ransomware operation that has appeared repeatedly in public breach reporting. Like other groups in this category, it typically follows a double-extortion model: after gaining access to a network, operators exfiltrate data and then threaten to publish it on a dedicated leak site if a ransom is not paid. Listings on such sites are claims by the group; they do not by themselves constitute independent confirmation that every asserted file was taken or that every named organisation was successfully compromised. Medusa has been associated with attacks on a range of sectors, often publicising sample files or directory listings to pressure victims. In this case, the group claims Travel Alberta’s internal files were among those taken; no additional statements attributed specifically to this incident beyond the listing and the 799.80 GB figure appear in the facts.

Travel Alberta and its sector

Travel Alberta is the provincial tourism marketing organisation for Alberta, Canada. Founded in 2009, it promotes the province as a destination, works with industry partners, and maintains a corporate presence in Calgary with a staff of about 110. Organisations of this type routinely hold internal operational records, marketing materials, partner and supplier information, and, in many cases, contact or booking-related data connected to tourism campaigns and stakeholder programmes. A breach involving a tourism marketing body can therefore touch both internal corporate material and information linked to external relationships. Because the sector often bridges government-adjacent promotion and private industry partners, any confirmed exposure of internal files carries consequences for operational continuity, partner trust, and the individuals whose details may appear in those files.

What was likely exposed

The facts name the exposed material as internal files exfiltrated in a ransomware attack, with a claimed data volume of 799.80 GB. No more granular inventory of file types, databases, or personal-data categories has been disclosed. Tourism marketing organisations typically maintain employee records, contracts, financial and operational documents, partner lists, and campaign-related contact information. Whether any of those categories were among the files taken in this incident is unconfirmed. Public detail is limited to the group’s assertion of internal-file exfiltration and the stated volume; exact contents remain unverified.

What's at stake

For people whose information may have been present in internal systems, the practical risks include unwanted contact, phishing that references real organisational details, and longer-term misuse of any personal or professional data that was stored. For the organisation, the stakes include potential disruption of marketing operations, strain on partner relationships, and the cost of investigation and remediation. Because the number of affected individuals is unknown and the precise file contents are unconfirmed, the full scale of individual impact cannot yet be stated. The claimed 799.80 GB volume indicates a substantial collection of material if accurate, but volume alone does not reveal sensitivity.

Were you affected?

If you have worked with, contracted for, or supplied personal or business details to Travel Alberta, treat the listing as a reason to take basic precautions while waiting for any official notification. Concrete first steps include:

• Monitor email and accounts for unexpected messages that reference Alberta tourism or Travel Alberta business.
• Change passwords on any accounts that reused credentials potentially stored in organisational systems, and enable multi-factor authentication where available.
• Watch financial and credit activity for unusual activity if you ever provided banking or identity details to the organisation.
• Retain any official notices you receive from Travel Alberta or Canadian authorities and follow their guidance.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Public reporting on this incident remains limited; further Reported Details may emerge as investigations proceed.

AICompiled with AI assistance from public sources and published under our editorial standards.