Down East Granite Listed by medusa Ransomware Group

On December 2, 2024, Down East Granite appeared on the Medusa ransomware group’s leak site, claiming the company suffered a ransomware attack in which internal files were exfiltrated. The Pennsylvania-based fabricator of granite, quartz, Corian, Dekton and other stone surfaces serves residential and commercial customers across Central Pennsylvania; anyone who has purchased countertops, received an estimate, or supplied materials to the firm in recent years may have personal information now at risk.

Details from the Medusa Listing

The Medusa leak site states that Down East Granite was compromised in a ransomware incident and that attackers successfully exfiltrated internal files. The listing does not disclose the exact number of records affected, the specific types of documents taken, or the ransom demand. It simply confirms data was allegedly stolen and gives the company a short window to negotiate before additional samples or full archives are published. The disclosure also does not name the initial access vector or the precise date of the intrusion.

Internal files exfiltrated is the only description provided. This phrasing typically means attackers copied documents from file servers, email archives, accounting systems, or customer databases before encrypting the original systems.

Why This Matters for You and Your Family

If you have done business with Down East Granite, your name, address, phone number, email, and possibly payment details or project specifications could be sitting in the stolen files. Stone fabricators routinely collect driver’s license copies for large purchases, Social Security numbers for business accounts, and detailed home addresses for installation scheduling. Once those records leave the company’s control, they become commodities on dark-web markets. Criminals combine them with other leaks to build complete profiles that enable identity theft, tax fraud, or targeted phishing campaigns against you and your household.

Even if the leak site has not yet published the full dataset, the mere confirmation that data was taken creates immediate pressure. Families cannot afford to wait until samples appear; by then the information may already be circulating among multiple threat actors.

Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one company’s files. A single customer record can link your home address to an email address, which in turn links to online accounts, gaming handles, or social-media profiles. Attackers follow these chains to locate children’s usernames on Roblox, Fortnite, or Discord, then use the same passwords or security questions exposed in the business breach to seize those accounts. The result is doxxing that reaches every member of the household.

Credential reuse across personal and business dealings turns one corporate breach into a gateway for account takeovers that expose photos, chat logs, location data, and financial information. Public reporting on similar incidents shows these chains frequently lead to extortion attempts against parents who discover their child’s gaming account has been hijacked and used to demand payment.

Medusa’s Known Track Record

Public reporting attributes Medusa’s emergence to late 2021. The group has since targeted organizations across manufacturing, healthcare, education, and professional services. Notable prior victims include mid-sized manufacturers and regional service firms whose customer data appeared on the same leak site. Medusa’s typical playbook begins with phishing or exploitation of remote-desktop services for initial access, followed by rapid lateral movement, data exfiltration, and deployment of their custom ransomware. They then extort victims through a combination of direct pressure and public leak-site publication, often releasing small proof samples before threatening to dump the entire archive. The group does not always encrypt systems if sufficient valuable data has already been stolen, shifting the attack into pure extortion.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used when dealing with Down East Granite or similar vendors, and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure that touches you or your family is caught within hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf while you focus on securing your own digital footprint.

The Medusa listing of Down East Granite is a reminder that even regional service companies hold information that can unravel years of careful privacy habits. Acting quickly on the exposure gives you the best chance of limiting damage before the data spreads further. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage including children’s gaming accounts provide the practical defense needed when corporate breaches reach your front door.