Medusa Ransomware Hits 500 US Firms: FBI Advisory 2026

Marcus Chen
September 6, 2026
13 min read

The FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Health and Human Services (HHS) have confirmed that Medusa ransomware has now hit more than 500 organizations since the group first appeared in June 2021, according to an updated joint advisory the agencies released in August 2026. The figure marks a jump from the 300-plus victims the same agencies reported in the original advisory, designated AA25-071A, back in March 2025 — meaning Medusa’s victim count grew by roughly two-thirds in about a year and a half, based on the agencies’ own numbers as summarized by Help Net Security and SC World.

The update lands in the middle of a broader spike in ransomware activity across the United States. Reuters reported on September 4, 2026 that companies worldwide are “grappling with a surge in AI-driven cyberattacks and ransomware that steal sensitive data and disrupt operations.” Just a week earlier, the same wire service confirmed that a separate ransomware group, Qilin, had breached a standalone system at the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). Medusa’s expanded victim count, healthcare-heavy targeting, and increasingly structured affiliate payouts make it one of the two or three ransomware-as-a-service (RaaS) operations security teams are watching most closely heading into the final quarter of 2026.

Don’t miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

What the FBI, CISA, and HHS Just Confirmed About Medusa

The updated advisory, issued jointly by CISA, HHS, and the FBI around August 18-19, 2026, states plainly that “Medusa developers and affiliates have impacted over 500 victims from a variety of critical infrastructure sectors.” That single sentence, repeated across multiple outlets covering the update, is the anchor fact behind this story. The agencies did not assign the update a new advisory number — it functions as a revision of the original #StopRansomware: Medusa Ransomware advisory (AA25-071A) that CISA, the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) first published on March 12, 2025.

That original 2025 version already carried weight: “As of February 2025, Medusa developers and affiliates have impacted over 300 victims from a variety of critical infrastructure sectors with affected industries including medical, education, legal, insurance, technology, and manufacturing,” the agencies wrote, in language quoted directly from the CISA advisory. The 2026 revision pulls in HHS as a co-author for the first time, a shift that lines up with the growing share of Medusa’s victims coming from hospitals and healthcare networks. It also broadens the named sectors to include defense, government services, IT, and financial services alongside healthcare and manufacturing.

What the advisory does not do is assign Medusa a precise affiliate count or list most of its victims by name. Federal ransomware advisories rarely do either, since attribution of individual intrusions to Medusa’s affiliate network is often established well after the fact through incident response engagements, not at the time a leak-site post appears. That reticence is itself informative: the 500-victim figure is a floor, not a ceiling, and it almost certainly understates Medusa’s real reach given how many ransomware victims never report an incident at all.

Inside the Medusa Ransomware-as-a-Service Operation

Medusa first surfaced in June 2021 as one of dozens of ransomware-as-a-service kits circulating on cybercrime forums, and the FBI, CISA, and MS-ISAC describe it directly: “Medusa is a ransomware-as-a-service (RaaS) variant first identified in June 2021.” Under the RaaS model, a small core team builds and maintains the encryption payload, negotiation infrastructure, and leak-site branding, then rents that toolkit out to affiliates who handle the actual intrusion, lateral movement, and ransom negotiation in exchange for a cut of whatever they collect.

Reporting on the August 2026 update, cited by SC World, describes an operation that “relies on speed to extort victims into making hefty payments often in the hundreds of thousands” of dollars. The advisory also details how Medusa recruits initial access brokers (IABs) — criminals who specialize in breaking into corporate networks and then selling that access rather than deploying ransomware themselves. According to the updated advisory language summarized in industry coverage, Medusa offers IABs anywhere from $100 to $1 million per engagement, a range wide enough to cover everything from a single compromised remote-desktop credential to access into a large enterprise network.

One detail from the advisory stands out as a sign of how commercialized these operations have become: victims can reportedly pay an additional $10,000 in cryptocurrency to buy themselves one extra day on the ransom countdown clock before their stolen data is published. That is not an isolated quirk — it reflects a broader trend across 2026’s top RaaS groups toward treating extortion timelines as a negotiable product feature rather than a fixed threat.

From 300 to 500 Victims: How the Threat Escalated in 18 Months

The jump from “over 300” victims in the February 2025 snapshot to “more than 500” in the August 2026 update works out to roughly 200 additional confirmed victims in about 18 months — an average of just over 11 new victims a month, based on the agencies’ own published figures. That pace tracks with what independent trackers are seeing across the ransomware ecosystem more broadly: as of the first week of September 2026, ransomware.live’s live tracker listed more than 10,300 total ransomware victims recorded in the United States, with new entries appearing daily.

That broader number is not Medusa-specific and comes from an independent, crowd-sourced tracking project rather than a federal agency, so it should be read as directional context rather than an official statistic. Still, it underscores why the FBI, CISA, and HHS felt an 18-month-old advisory needed a refresh: the volume of ransomware activity targeting US organizations has not slowed, and a single RaaS brand crossing the 500-victim mark is now one data point among thousands rather than an outlier.

Which Sectors Medusa Is Targeting Now

The sector list attached to the August 2026 advisory update is noticeably broader than the one from March 2025. The original advisory named medical, education, legal, insurance, technology, and manufacturing organizations as Medusa’s primary targets. The 2026 revision keeps healthcare and manufacturing on the list but adds defense, government services, IT, and financial services — an expansion that mirrors what HHS’s involvement as a co-author would suggest: healthcare has become enough of a recurring target that a health-sector regulator is now co-signing the warning.

Industry reporting on the update points to one specific case from inside that healthcare push: an incident at the University of Mississippi Medical Center in February 2026, described as Medusa-linked in coverage of the advisory. Federal advisories rarely name victims directly, so having even one confirmed institution attached to the case gives defenders a concrete example of what a Medusa intrusion into a hospital system looks like in practice — typically a mix of encrypted clinical or administrative systems and a threat to publish exfiltrated patient data if payment isn’t made.

Double Extortion, Triple Extortion: How the Ransom Playbook Works

Medusa runs what security researchers call a double extortion model: affiliates encrypt a victim’s systems and simultaneously exfiltrate data, then threaten to publish that stolen data on a leak site if the ransom isn’t paid — giving victims two separate reasons to comply even if they can restore from backups. That structure is now standard across most major RaaS brands, but Medusa has occasionally gone a step further. The original 2025 advisory documented a case where, after a victim paid an initial ransom, a separate actor within the affiliate chain demanded half of that payment again to hand over a “true decryptor” — behavior the advisory flagged as “potentially indicating a triple extortion scheme.”

That detail matters for any organization weighing whether to pay. A second, unexpected demand from a different actor after the first payment clears means there is no guarantee that paying resolves the incident, even when a decryption key is delivered as promised. The FBI, CISA, and MS-ISAC address this directly in guidance included in the advisory: “The FBI, CISA, and MS-ISAC do not encourage paying ransoms as payment does not guarantee victim files will be recovered.” That is not a new position for federal agencies, but Medusa’s documented triple-extortion attempt gives it unusually concrete backing.

Medusa vs Qilin vs Rhysida vs Cl0p: How 2026’s Top Ransomware Gangs Compare

Medusa is far from the only RaaS brand active this year, and its profile looks different from the other groups making headlines across 2026. Qilin claimed the ATF breach that Reuters confirmed on August 27, 2026, and has separately claimed a wave of victims including Northern Leasing Systems, Metal Conversions, California Truck Equipment, and WireCo, according to TechRadar Pro’s coverage of the ATF incident. Rhysida claimed responsibility for the Berlin government ransomware incident this year, reportedly exfiltrating close to 5.79 TB of data. Cl0p, meanwhile, built its 2026 campaign around exploiting a flaw in PTC’s Windchill software, pulling in victims that included Shell, GE, and Philips.

What separates Medusa from that pack is its age and its documented affiliate economics. Where Qilin, Rhysida, and Cl0p tend to generate headlines around single large breaches, Medusa’s federal advisory is built around a five-year operating history and a specific, disclosed payment structure for initial access brokers. That combination — longevity plus a transparent-enough business model that federal investigators can describe its pricing tiers — is part of why the FBI, CISA, and HHS treat it as a standing critical infrastructure threat rather than a single-incident story.

Why Ransomware-as-a-Service Keeps Scaling in 2026

The RaaS model succeeds because it splits ransomware operations into specialized labor. Core developers never have to touch a victim network directly, which reduces their exposure to law enforcement. Affiliates and initial access brokers, in turn, don’t need to write malware — they need a foothold and the patience to negotiate. Medusa’s $100-to-$1-million IAB payment range, as described in coverage of the updated advisory, is wide enough to make selling access profitable at almost any scale, from a small manufacturer to a hospital network with tens of thousands of patient records.

That specialization is also why advisories like this one focus heavily on patching and network segmentation rather than on any single exploit. The CISA advisory’s mitigation guidance urges organizations to keep operating systems, software, and firmware patched on a risk-informed schedule, segment networks to limit lateral movement, and filter remote service access from unknown or untrusted sources — all measures aimed at closing the kind of easily-brokered access that feeds the IAB market Medusa depends on.

The AI-Driven Surge Behind This Year’s Attack Wave

Medusa’s updated victim count didn’t arrive in isolation. Reuters reported on September 4, 2026 that companies worldwide are dealing with a surge in AI-driven cyberattacks and ransomware, a trend that has shown up repeatedly in the outlet’s cybersecurity coverage through August and September. Separately, the FBI said in early September that the Medusa-unrelated Rhysida and Qilin cases, along with a confirmed breach of the ATF, reflect a wider pattern of ransomware crews moving faster and hitting higher-profile targets than in prior years.

None of the public reporting on Medusa specifically confirms that its affiliates are using generative AI tools in their intrusions — that claim applies to the broader 2026 ransomware surge Reuters described, not to Medusa by name. The distinction matters: it would be inaccurate to say Medusa itself has been proven to use AI tooling, but accurate to say Medusa’s expansion is happening at the same time, and inside the same overall environment, that federal officials and Reuters are describing as an AI-accelerated attack wave.

Market Impact: What This Means for Cybersecurity Budgets

No public reporting available at the time of this article ties the Medusa advisory update directly to a stock-price move for any specific cybersecurity vendor or affected company — that kind of direct market reaction, if it exists, has not been documented in the sources covering this update. What is documented is a pattern: healthcare and critical infrastructure operators facing repeated RaaS targeting tend to accelerate spending on endpoint detection, network segmentation, and incident response retainers in the months following a high-profile advisory, a dynamic that shows up across multiple 2026 breach cycles this year, from the ATF’s Qilin incident to Berlin’s Rhysida breach. Some organizations have turned to structured vulnerability scanning programs and faster CISA KEV patch workflows to close the access gaps that feed RaaS affiliate networks like Medusa’s.

For enterprise security teams, the more immediate budget implication is compliance-driven rather than market-driven. HHS’s decision to co-author the Medusa update alongside CISA and the FBI signals that healthcare-sector cybersecurity requirements are likely to tighten further, particularly around the patching and segmentation controls the advisory calls out. Organizations in the newly added sectors — defense, government services, IT, and financial services — should expect similar scrutiny if their own incident counts climb.

Historical Context: From Early RaaS Kits to Today’s Affiliate Economies

Ransomware-as-a-service is not a new concept — kits offering ransomware “franchises” to affiliates date back to well before Medusa’s 2021 debut, with groups building the underground business model that later brands like LockBit scaled into a mass-market criminal enterprise. What has changed by 2026 is the sophistication of the economics: rather than a flat affiliate cut, Medusa’s advisory describes a tiered marketplace for access ($100 to $1 million depending on the target), a pay-to-delay feature on ransom deadlines ($10,000 per extra day), and at least one documented case of a secondary actor extracting a second payment from an already-paying victim.

That evolution mirrors what CISA and the FBI have flagged in other 2026 cases. The Cl0p group’s exploitation of the PTC Windchill vulnerability, the breach and ransom demand disclosed by McKesson, and Qilin’s claimed breach of a federal law enforcement agency all point to the same underlying shift: ransomware operators are increasingly targeting the software supply chain and large data holders that sit upstream of many other organizations, rather than picking off individual companies one at a time.

What the Advisory Tells Defenders To Do

The joint advisory’s guidance is consistent with what CISA has published in prior #StopRansomware bulletins, but it carries extra weight given Medusa’s five-year track record. The agencies reiterate that “regardless of whether you or your organization have decided to pay the ransom, FBI, CISA, and MS-ISAC urge you to promptly report ransomware incidents to FBI’s Internet Crime Complaint Center (IC3), a local FBI Field Office, or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center.” That reporting requirement is not just a courtesy to investigators — it’s how advisories like this one get updated victim counts and TTP data in the first place.

For technical teams, the advisory’s core recommendations map directly onto Medusa’s known access methods: patch internet-facing systems on a risk-informed timeline, segment networks so that a single compromised device can’t reach an entire environment, and restrict remote access services to known, trusted sources. Because Medusa leans so heavily on purchased initial access rather than novel exploits, basic access hygiene closes off a meaningful share of the pathways its affiliates rely on.

Predictions: Where the Medusa Threat Goes From Here

Based on the trajectory documented across the two advisory versions and the broader 2026 ransomware landscape, a few trends look likely to continue through the rest of the year:

• Medusa’s victim count will keep climbing past 500, and a further advisory update is plausible if the group maintains its roughly 11-victim-per-month pace from the past 18 months.
• More federal agencies beyond HHS could be pulled into future advisories as Medusa and similar RaaS brands broaden into new critical infrastructure sectors, following the same pattern that added defense, government, IT, and financial services this year.
• Initial access brokers will remain the primary entry point for Medusa-style attacks, keeping basic patching and remote-access hygiene as the highest-leverage defensive investment for most organizations.
• Expect continued convergence between separate ransomware stories in 2026 — Medusa, Qilin’s ATF breach, Rhysida’s Berlin incident, and Cl0p’s Windchill campaign are increasingly discussed together by federal agencies and researchers as evidence of a single accelerating trend rather than isolated incidents.
• Triple-extortion tactics, so far documented in at least one Medusa case, are likely to appear in other RaaS operations’ playbooks if they continue generating additional payments from already-compromised victims.

Frequently Asked Questions

What is Medusa ransomware?

Medusa is a ransomware-as-a-service operation first identified in June 2021. Its core developers provide the malware and infrastructure, while affiliates carry out the actual network intrusions and ransom negotiations, according to the joint FBI, CISA, and MS-ISAC advisory.

How many victims has Medusa ransomware hit?

The FBI, CISA, and HHS confirmed in an updated joint advisory around August 18-19, 2026 that Medusa has breached more than 500 organizations since June 2021, up from the 300-plus victims reported in the original March 2025 advisory.

Which industries does Medusa ransomware target?

The 2026 advisory update names healthcare, defense, manufacturing, government services, information technology, and financial services. The original 2025 advisory listed medical, education, legal, insurance, technology, and manufacturing sectors.

Does Medusa use double or triple extortion?

Medusa primarily uses double extortion — encrypting systems while also stealing data and threatening to publish it. The original advisory also documented one case where a secondary actor demanded an additional payment after an initial ransom was paid, which investigators described as potentially indicating a triple extortion scheme.

Should organizations pay a Medusa ransom demand?

The FBI, CISA, and MS-ISAC do not encourage paying ransoms, stating that payment does not guarantee recovery of victim files. The agencies instead urge organizations to report incidents promptly to the FBI’s Internet Crime Complaint Center (IC3), a local FBI field office, or CISA.

How does Medusa compare to Qilin, Rhysida, and Cl0p?

Medusa has a longer operating history (since 2021) and a federally documented affiliate payment structure. Qilin claimed the 2026 ATF breach, Rhysida claimed the Berlin government incident, and Cl0p built its 2026 campaign around exploiting a flaw in PTC’s Windchill software. All four rely on some form of data-theft extortion, though their targeting and public profile differ.

What is an initial access broker and why does it matter for Medusa?

An initial access broker (IAB) is a criminal who breaks into a network and then sells that access rather than deploying ransomware directly. Medusa’s advisory describes payments to IABs ranging from $100 to $1 million per engagement, making brokered access a central part of how the group finds new victims.

What should security teams do in response to this advisory?

CISA’s guidance calls for patching operating systems, software, and firmware on a risk-informed schedule, segmenting networks to limit lateral movement, and filtering remote service access from unknown or untrusted sources — measures aimed directly at the brokered-access model Medusa’s affiliates rely on.