[MEDUSA] – Ransomware Victim: Imagicle

image

NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the MEDUSA Onion Dark Web Tor Blog page.

Ransomware group:
MEDUSA
Victim name:
IMAGICLE

AI Generated Summary of the Ransomware Leak Page

Imagicle, a technology company headquartered in Italy, is identified as the victim in a ransomware leak post. The post is timestamped 2025-10-19 09:46:56.000000, which serves as the posting date for the leak in the absence of a disclosed compromise date. The leaked page provides Imagicle’s corporate background, noting founding in 2010 and a global footprint with subsidiaries in Dubai and Miami, along with a reported workforce of 132 employees. The description emphasizes Imagicle’s role as a technology provider with international reach, and the company address is redacted to protect private information. The presence of a claim URL indicator on the page suggests the attackers may present ransom or data-exfiltration content, but the extracted data does not include the specific terms or figures. The visible excerpt requires human verification (captcha) to proceed, so the leaked content itself is not accessible in the provided portion. No screenshots, images, or downloadable assets are listed in the available metadata (images_count is 0; downloads_present is false).

Regarding the page’s content, the material centers on Imagicle’s identity and corporate background rather than showing leaked documents within the available excerpt. The post date is present and serves as the publication date; there is no explicit compromise date disclosed in the data. The presence of a claim URL hints at potential ransom or data-leak messaging on the page, yet the provided fields do not reveal any ransom amounts or the nature of the exfiltrated data. PII such as emails, phone numbers, and addresses has been redacted, while the victim name Imagicle remains, as requested. The leak post, as captured, provides a high-level victim profile and posting date but does not present public artifacts or concrete evidence of the breach’s impact in the extracted portion.

Support Our Work

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.

AI APIs OSINT driven New features