American Golf Listed by Medusa Ransomware Group

On July 12, 2024, American Golf appeared on the leak site operated by the Medusa ransomware group. The company, which owns, leases, and manages golf courses and country clubs across the United States, had 154.9 GB of internal files exfiltrated during a ransomware attack. The Medusa listing does not specify the exact number of people affected or list the precise data types contained in the files.

Details from the Medusa Listing

The primary disclosure on the Medusa leak site states that American Golf suffered a ransomware incident resulting in the theft of internal company files. The listing includes a sample of the allegedly stolen data and notes the 154.9 GB volume. No customer records, employee counts, or specific categories such as names, addresses, payment details, or health information are detailed in the public posting. The corporate headquarters address in El Segundo, California, and the company’s 50-plus years of operation are confirmed through its own public information, but the breach notification itself does not quantify how many individuals may have their information inside the stolen files.

The disclosure indicates the data was exfiltrated prior to the listing and that American Golf has not met the group’s demands. As is typical with these postings, the exact deadline for any extortion payment is no longer relevant once the data is published.

Why This Matters for You and Your Family

When a company like American Golf that manages recreational facilities has internal files stolen, the exposure often reaches beyond corporate spreadsheets. Golf clubs routinely collect names, home addresses, phone numbers, email addresses, and payment information from members and their families. If your family has ever joined a club, attended an event, or maintained a membership, your details could be among the 154.9 GB now in attackers’ hands. Even without exact record counts, the real-world risk is concrete: stolen contact and financial data can be sold, combined with other breaches, and used for identity theft, phishing, or targeted scams against you or your relatives.

Doxxing and Identity-Chain Risks

Internal files from organizations frequently contain spreadsheets that link names to addresses, membership numbers, emergency contacts, and sometimes children’s names or dates of birth. Once published on a ransomware site, this information accelerates doxxing chains. Attackers or opportunistic criminals can cross-reference the data with usernames, gaming handles, or social-media profiles to build a full picture of your household. Credential leaks that surface in the same datasets often allow account takeovers on email, banking, or gaming platforms. The result is a cascading exposure where one breach exposes not only your identity but also the linked accounts of spouses and children.

Medusa Ransomware Group Track Record

Public reporting attributes Medusa’s emergence to late 2022. The group has since targeted organizations across North America, Europe, and Asia, with notable prior victims including manufacturing firms, healthcare providers, and retail operators. Their typical playbook begins with initial access through compromised credentials or vulnerable remote desktop services, followed by lateral movement inside the network, data exfiltration, and deployment of ransomware. After encryption, Medusa posts samples on their leak site and demands payment to prevent full publication. The group’s extortion style combines technical encryption with public shaming, often giving victims a short window before releasing larger data samples.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate any password you used for American Golf membership portals, club apps, or related services anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which frequently chain back to the same address or parent email.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this or linked incidents.

The incident underscores that even organizations outside heavily regulated sectors can become gateways to personal exposure for ordinary families. One timely scan and ongoing vigilance can break the chain before criminals turn stolen golf-club files into long-term identity threats. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.