Ransomware Group: MEDUSA

VICTIM NAME: DeVita & Associates, Inc[.]

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the MEDUSA Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware group “Medusa” has publicly released a significant amount of data stolen from DeVita & Associates, Inc., a structural engineering firm based in Greenville, South Carolina. The data breach was discovered on May 14, 2025, and the attack occurred on May 13, 2025. The compromised information includes approximately 618.4 GB of corporate data. The threat actors are demanding a ransom of 150,000 USD to prevent the leak of sensitive information.

The leak page features a screenshot showing internal documents and information related to the victim company, along with a link to the detailed leak on the dark web. The website of the victim, devitainc.com, is noted, but no specific employee or individual PII has been disclosed in the publicly available summary. The attack appears to be part of a broader campaign by the Medusa ransomware group, which has targeted organizations across the United States, though the industry activity remains unspecified. The leak suggests the exfiltration of engineering and possibly proprietary project data, which could impact the company’s operational security and client confidentiality.