ValeCard Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 12, 2024, the Brazilian company ValeCard was listed by the medusa ransomware group, which claims to have exfiltrated 107.6 GB of internal files in a ransomware attack. The number of people affected remains unknown, and public detail on the precise method or full scope of the incident is limited.

ValeCard provides solutions for managing benefits, finances and related services. A listing of this kind raises concerns for the organisation and anyone whose information may have been among the claimed internal files, even while independent confirmation of the full details is not yet available.

What happened

According to the available record, ValeCard was listed by the medusa ransomware group on or around July 12, 2024. The group claims that internal files were exfiltrated during a ransomware attack and that the total volume of data involved is 107.6 GB. No further public confirmation of the attack timeline, initial access method, or exact sequence of events has been disclosed. The number of individuals potentially affected is listed as unknown.

The listing itself constitutes a claim by the group rather than an independently verified statement of compromise. Details beyond the reported data volume and the characterisation of the material as internal files remain limited in public sources.

Who is medusa?

Medusa is a ransomware operation that has been publicly documented as using double-extortion tactics: encrypting systems while also exfiltrating data and threatening to publish it on a dedicated leak site if a ransom is not paid. The group typically advertises victims on its leak site with claims about stolen data volumes and file types, then releases samples or full archives when negotiations fail or deadlines pass.

Like other ransomware groups of this type, medusa has been associated with attacks on organisations across multiple sectors and countries. Its public listings are claims that require separate verification; they do not by themselves prove the accuracy of every detail asserted about a given victim. In this case, the listing of ValeCard and the stated 107.6 GB figure should be understood as the group’s assertion pending further confirmation.

About ValeCard

ValeCard was founded in 1995 and operates from a corporate office at 904 R Machado De Assis, Uberlandia, Minas Gerais, 38400-112, Brazil. Public records indicate it employs approximately 399 people. The company provides complex and integrated solutions for managing benefits, finances and frosts, placing it in the benefits-administration and financial-services sector that serves corporate clients and their employees.

Organisations of this kind typically handle sensitive operational, financial and personnel-related information on behalf of client companies. A ransomware incident involving claimed exfiltration of internal files is therefore consequential both for ValeCard’s own operations and for the third parties whose data may reside in those systems. Public detail does not establish negligence or specific security failures; it simply records the listing and the claimed data volume.

The information in question

The available facts state that internal files were exfiltrated in a ransomware attack and that the total amount of data leakage claimed is 107.6 GB. No more granular inventory of file types, databases or personal-data categories has been publicly disclosed. The number of people affected is unknown.

Companies that manage benefits and financial solutions commonly hold employee identifiers, payroll or voucher data, client contracts, internal correspondence and operational records. Whether any of those categories were present among the claimed 107.6 GB remains unconfirmed. Readers should treat the precise contents as undisclosed rather than assume specific data elements may have been exposed.

What's at stake

For individuals, the primary risk is that personal or employment-related information, if present in the exfiltrated files, could be misused for fraud, social engineering or identity-related harm. Because the exact data types and the number of affected people are unknown, the concrete exposure for any single person cannot yet be quantified.

For ValeCard, the stakes include potential operational disruption, regulatory scrutiny under Brazilian data-protection rules, contractual obligations to clients, and reputational impact arising from the public listing. The claimed 107.6 GB volume, if accurate, represents a substantial internal archive whose unauthorised release could affect both the company and the organisations it serves. These risks remain contingent on verification of the group’s claims and on any subsequent disclosure of the actual contents.

What to do if you're exposed

If you have a relationship with ValeCard—as an employee, client contact or benefits recipient—consider the following practical steps while public detail remains limited:

• Monitor financial and benefits accounts for unexpected activity and enable any available transaction alerts.
• Treat unsolicited requests for personal or payment information with heightened caution, as attackers sometimes use leaked data for phishing.
• Change passwords on related accounts and enable multi-factor authentication where offered.
• Request a free exposure scan of your email address to check whether it has already appeared in known breach datasets.
• Follow any official notifications issued by ValeCard or relevant authorities for further guidance once more information becomes available.

Because the number of people affected and the precise data types remain unknown, these measures are precautionary rather than a response to confirmed personal exposure. Stay alert for verified updates from the company itself.

AICompiled with AI assistance from public sources and published under our editorial standards.