The Courier Guy is investigating claims that ransomware group MedusaLocker breached its systems and stole internal company data.
MedusaLocker listed the South African courier company on its dark web leak site and claimed it had extracted emails and other internal documents. The group threatened to release the material if it was not sold.
The Courier Guy told MyBroadband that the publication’s questions were the first it had heard of the alleged incident.
The company said it currently had no evidence that its internal systems had been compromised.
Company says customer data appears safe
The Courier Guy said its initial review gave it confidence that no customer information had been exposed.
It has not notified South Africa’s Information Regulator because it currently has no evidence confirming that a data breach occurred.
The company said it would follow the required process under the Protection of Personal Information Act if its investigation found otherwise.
For now, the alleged breach remains unconfirmed.
Alleged data listed for R485,000
MedusaLocker’s leak site reportedly displayed filenames that appeared to relate to internal financial and strategic company documents.
The files themselves were not publicly available for inspection.
The group listed an apparent selling price of $30,000, around R485,000, for the alleged data.
MyBroadband noted that fake data leaks also occur, where criminals attempt to sell unrelated, fabricated or non-existent information.
MedusaLocker is known ransomware group
MedusaLocker is an established ransomware threat rather than an unknown name appearing for the first time.
A joint cybersecurity advisory from the FBI and US Cybersecurity and Infrastructure Security Agency said the ransomware has been active since at least 2019.
Authorities say the group has used vulnerabilities in Remote Desktop Protocol to access networks before encrypting files and demanding payments in Bitcoin.
It has also operated as a ransomware-as-a-service network, allowing affiliates to deploy its malware.
The Courier Guy said it was treating the claim seriously and investigating it as a priority, while maintaining confidence in its core security systems.