EHPAD Listed by medusa Ransomware Group

On October 23, 2023, French nursing-home operator EHPAD appeared on the leak site of the Medusa ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the company, which runs multiple residential facilities for elderly dependents across France. The primary disclosure does not quantify how many residents, staff members or family contacts were affected, nor does it list the specific data types inside the stolen files.

Details in the Medusa Listing

The Medusa leak site entry, first observed on October 23, 2023, claims that EHPAD’s internal documents were taken after the ransomware deployment. It provides the company’s head-office address at 69 Rue République, Trun, Normandy, 61160, France, and notes that EHPAD operates several branches. The posting does not publish sample data, does not state the volume of records involved, and does not set an explicit extortion deadline in the publicly visible portion of the listing. As is common with these sites, the full archive remains behind the group’s payment portal.

Why This Matters for You and Your Family

If you or an elderly relative has lived in or received care from an EHPAD facility in France, your personal information may sit inside the stolen files. Nursing homes routinely hold medical histories, government identification numbers, insurance details, next-of-kin contacts, bank-account references for billing, and signed consent forms. When that information leaves the premises without consent, the risk of fraud, identity theft and targeted scams against older adults rises sharply. Even without an exact headcount, the disclosure states that internal files were exfiltrated, so anyone connected to the organisation should treat their data as exposed.

Doxxing and Identity-Chain Risks

Ransomware operators rarely stop at one dataset. A single leaked nursing-home spreadsheet can link a resident’s name and address to family members’ phone numbers, email accounts and sometimes even grandchildren’s social-media handles. Attackers then follow those connections across dozens of other breaches. The result is an identity chain that can expose gaming accounts, school records or workplace logins belonging to younger relatives. Credential leaks like this one cascade into account takeovers that reach far beyond the original victim. DoxxScan by GalaxyWarden continuously monitors 13.1B+ breach records and 100+ platforms with AI-powered identity-chain mapping, helping surface these hidden linkages before they are exploited.

Medusa’s Publicly Known Track Record

Public reporting attributes Medusa’s first major campaigns to late 2021. The group has since listed hundreds of victims, focusing on mid-sized organisations in Europe and North America. Typical playbook begins with phishing or compromised remote-desktop credentials, followed by rapid lateral movement, data exfiltration and then dual extortion: demanding payment to prevent file encryption and a second fee to stop publication of stolen documents. Medusa often gives victims a short window—sometimes seven to fourteen days—before samples or full archives appear on their onion site. The EHPAD listing fits this pattern exactly.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring so the next breach exposing you or a family member is caught in hours rather than months.
• Rotate any password used at EHPAD or related French healthcare portals anywhere it has been reused, and switch on 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data-broker sites and extortion portals on your behalf.

The EHPAD breach is a reminder that care facilities holding sensitive elder data remain attractive targets. Acting quickly on the credentials and linkages that surface from such incidents limits how far attackers can travel down the identity chain. Start your DoxxScan trial today and place continuous monitoring plus specialist remediation between your family and the next leak.