International Center of Photography Listed by medusa Ransomware Group

On February 19, 2023, the International Center of Photography in New York appeared on the leak site of the Medusa ransomware group. The listing states that internal files were exfiltrated during a ransomware attack against the institution, which employs 374 people and is dedicated to photography and visual culture. Anyone whose personal information was stored in those systems—including staff, donors, members, contractors, or individuals featured in ICP records—may now be exposed.

Reported Details from the Listing

The Medusa leak site entry, still accessible via its onion address, claims successful data exfiltration from the International Center of Photography. It does not publicly quantify the number of records taken or list specific data types beyond stating that internal files were obtained. The disclosure indicates the breach occurred as part of a ransomware incident, though the exact date of initial compromise remains undisclosed by both the group and the victim. Public mirrors of the leak site, such as ransomware.live, preserve the original posting timestamp of February 19, 2023. No formal victim notification or regulatory filing has surfaced that adds further specifics on what was taken.

Why This Matters for You and Your Family

When a cultural institution like the International Center of Photography suffers a ransomware breach, the impact reaches far beyond its walls. Staff members, volunteers, donors, and even people who attended events or submitted work may have had addresses, phone numbers, dates of birth, financial details, or correspondence stored in the compromised systems. If your information was there, it may now be in the hands of criminals who specialize in extortion. 374 employees alone suggests a sizable pool of individuals whose data could be leveraged for identity theft, phishing, or further targeting of family members. Even if you are not an employee, your records as a patron, artist, or donor could still be part of the stolen material.

The Doxxing and Identity-Chain Risks

Ransomware operators rarely stop at posting generic “proof” files. Once internal documents leave an organization, attackers and subsequent buyers can map email addresses to personal accounts, link employee directories to home addresses, and chain together enough fragments to dox individuals or their families. A single leaked work email often unlocks personal reuse across banking, social media, and children’s school portals. These identity chains frequently extend to gaming accounts, where usernames, linked emails, and payment methods create additional exposure points that can be exploited for harassment or further theft. The longer the data sits on a leak site, the more likely it is to be repackaged and sold on additional underground forums.

Medusa Group’s Known Track Record

Public reporting attributes the emergence of the Medusa ransomware group to mid-2021. Since then the gang has targeted organizations across healthcare, education, manufacturing, and nonprofit sectors. Notable prior victims include municipal governments, manufacturing firms, and other cultural institutions whose internal networks held sensitive personal and financial records. Their typical playbook begins with initial access gained through phishing, remote desktop protocol brute-force, or exploited vulnerabilities, followed by exfiltration of documents before encryption. Medusa then posts samples on their leak site and demands payment to prevent full publication, often setting short deadlines and increasing pressure by releasing additional data batches. The group’s leak site remains one of the more active ransomware extortion platforms still operating as of this writing.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you used at the International Center of Photography or related systems, then enable 2FA through an authenticator app instead of SMS.
• Cover your entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same breached address or email.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The Medusa listing of the International Center of Photography is a reminder that even respected cultural organizations can become gateways to personal exposure. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to cascading takeovers. Start your DoxxScan trial today to lock down what matters most.