Galaxy Fireworks, Inc Listed by Medusa Ransomware Group

On January 31, 2024, Galaxy Fireworks, Inc. appeared on the Medusa ransomware group’s leak site. The Florida-based importer, wholesaler and retailer of fireworks, founded in 1984 with 26 employees, may have had its internal files exfiltrated during a ransomware attack. The listing does not specify the number of records affected or the exact data types stolen beyond claiming that sensitive corporate documents were taken.

Details from the Medusa Listing

The primary disclosure on the Medusa leak site states that Galaxy Fireworks suffered a ransomware compromise and that attackers successfully exfiltrated internal files. No ransom amount, negotiation status, or download links for the full dataset are publicly detailed in the initial listing. The company’s Tampa headquarters address at 204 E Dr Martin Luther King Jr Blvd is referenced in publicly available business records that align with the victim profile posted by the group. The disclosure indicates the data was obtained through a ransomware operation but does not describe the initial access vector or the precise volume of material taken.

Internal files exfiltrated is the only category listed, leaving customers, suppliers, and employees uncertain about whether names, addresses, payment records, or employee tax documents were included.

Why This Matters for You and Your Family

When a local business like Galaxy Fireworks is hit, the impact often reaches beyond the company. If you have purchased fireworks, worked there, supplied products, or share any connection with the firm, your personal information may now sit in an attacker’s archive. Even basic customer or vendor records can contain phone numbers, shipping addresses, and payment details that criminals later use for identity theft or targeted scams. Families in the Tampa area and across the Southeast who have done business with the company should assume their contact information is at risk until proven otherwise.

The breach also highlights how small and midsize businesses remain prime targets. With only 26 employees, Galaxy Fireworks likely lacked the security staffing of larger corporations, a reality that mirrors thousands of firms handling your data every day.

Doxxing and Identity-Chain Risks

Exfiltrated internal files frequently contain spreadsheets that link names, emails, phone numbers, and physical addresses. Attackers can combine this information with data from previous breaches to build detailed profiles. A single leaked customer record can anchor an identity chain that reveals your social-media handles, family relationships, and even children’s online gaming accounts. Once criminals map these connections, they can launch convincing spear-phishing campaigns or sell the bundle on underground forums. Credential leaks of this nature routinely cascade into account takeovers across unrelated services where the same email and password were reused.

Medusa Ransomware Group Track Record

Public reporting attributes Medusa’s emergence to mid-2021. The group operates a double-extortion model: they encrypt victim systems and threaten to publish stolen data unless a ransom is paid. Notable prior victims include healthcare providers, manufacturers, and other small-to-medium businesses whose internal documents were later posted on their leak site. Typical playbooks involve initial access through phishing, remote-desktop compromise, or exploited vulnerabilities, followed by claimed exfiltration of sensitive files before encryption. Medusa maintains an active onion site and frequently updates listings with countdown timers, applying steady pressure on victims who fail to meet demands.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including cleanup of exposed records.
• Rotate any password you used for accounts tied to Galaxy Fireworks and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to credential-based takeovers.
• Let remediation specialists handle data-broker takedown requests and follow-up monitoring on your behalf.

The Galaxy Fireworks breach is a reminder that ransomware groups continue to target everyday businesses that hold ordinary people’s information. Staying ahead requires more than hoping your data stays private. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts where credential leaks often lead to doxxing chains. Starting proactive defense now limits the damage from incidents that surface weeks or months later.