Agència Catalana de Notícies (ACN) Listed by medusa Ransomware Group

On October 6, 2023, the Agència Catalana de Notícies (ACN) appeared on the leak site operated by the Medusa ransomware group. The Catalan news agency, one of Europe’s earliest digital wire services founded in 1999, had its internal files exfiltrated during a ransomware attack. The listing does not specify how many individuals are affected or exactly which records were taken, but anyone whose personal data has passed through ACN systems could now be exposed.

Primary Disclosure Details

The Medusa leak site entry states that ACN suffered a ransomware incident and that attackers successfully exfiltrated internal files. No victim count, no list of specific data types, and no ransom demand figure are published on the page. The disclosure simply states that stolen data is available for download to anyone who pays the group’s fee or waits for it to be released publicly. The agency’s Barcelona headquarters address is listed alongside the sample files, matching the public record for its office at Avinguda Josep Tarradellas.

Internal files exfiltrated is the only description the attackers provide. This phrasing typically means documents, spreadsheets, emails, and databases that news agencies routinely store on shared drives or cloud repositories. Because ACN supplies news content to media outlets, government bodies, and private subscribers across Spain, those files could contain contact lists, source information, billing records, or employee details.

Why This Matters for You and Your Family

When a news agency loses control of internal files, the people named inside them face immediate privacy erosion. Journalists, sources, freelancers, subscribers, and administrative staff may have addresses, phone numbers, national identification numbers, or financial details stored in those systems. If your name, email, or contact information ever appeared in correspondence with ACN, that record could now sit on a ransomware portal accessible to identity thieves, stalkers, or fraudsters.

Exposure of internal files often cascades beyond the company itself. Family members linked through shared addresses, children listed on school-related press releases, or spouses named in HR documents become part of the same exposure chain. The breach therefore touches not only direct ACN contacts but also households connected to them.

Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at publishing one folder. Once initial data appears, opportunistic actors scrape names, emails, and phone numbers and feed them into doxxing databases. These records are then cross-referenced with gaming accounts, social-media handles, and breached passwords from unrelated incidents. A single leaked work email can unlock a chain that reveals your home address, children’s names, and online personas within hours.

Credential reuse makes the danger worse. Many journalists and freelancers reuse passwords across work accounts, personal email, and gaming platforms. When those credentials surface in the Medusa package, account takeovers become trivial. Children’s gaming accounts that share the same family email domain are especially vulnerable because parents often apply the same password habits at home.

Medusa Group Track Record

Public reporting attributes Medusa’s first major campaigns to late 2021. The group operates a double-extortion model: it encrypts victim networks and simultaneously exfiltrates data before demanding payment to prevent publication. Notable prior victims include manufacturing firms, healthcare providers, and local government agencies across Europe and North America. Medusa typically gains initial access through compromised remote desktop credentials or phishing emails that deliver custom loaders. After exfiltration, the group posts samples on its onion site and sets a payment deadline, after which it begins gradual data dumps or sells the archive to other criminals. The exact tactics used against ACN remain unknown, but the group’s consistent playbook suggests the agency was likely compromised via standard intrusion methods rather than a novel zero-day.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used at ACN or associated Catalan media services, and enable 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught and acted upon in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and emails leaked in incidents like this.
• Let remediation specialists handle takedown requests across data-broker sites and leak forums that begin reselling the ACN files.

The ACN listing is a reminder that even established news organizations can become unwilling gateways to personal data theft. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain that begins with this claimed breach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from cascading credential leaks.