Medusa gang listed nonprofit Water for People with a $300,000 demand

Water for People, a Colorado-based nonprofit that develops drinking water and sanitation services in under-resourced countries, was named on the Medusa ransomware gang's leak site in January 2024.

The group, a ransomware-as-a-service operation first identified in June 2021 and unrelated to the separate MedusaLocker family, threatened to publish data it said it had taken unless the nonprofit paid. According to The Cyber Express, the listing set out a tiered demand: $300,000 to have the data deleted, the same amount for any third party wanting to download it immediately, and $10,000 to extend the countdown by a day. The post carried a deadline of roughly ten days.

Water for People said the material the attackers reached predated 2021, that its financial systems had not been compromised and that business operations were not disrupted. The organization said it had engaged incident response specialists and worked with its insurer and internal security staff, and that it had attempted to open a dialogue with the attackers.

A spokesperson said the episode showed that nonprofits are also targets for these groups. Water for People operates in nine countries and had recently received a $15 million grant from MacKenzie Scott toward expanding water access. There was no indication that the grant made it a target. The scale of the data involved was not established publicly.