Oscars Group Listed by medusa Ransomware Group

On November 5, 2025, the Medusa ransomware group added Oscars Group to its leak site, claiming that internal files had been exfiltrated from the Australian hospitality company during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates that Oscars Group, founded in 1986 by the Gravanis brothers, operates more than 35 venues across New South Wales. These include pubs, hotels, accommodation, events centres, gaming facilities, retail liquor outlets and residential developments. The company is headquartered at Level 6, Bayside Tower, 376 Bay Street, Brighton-Le-Sands NSW 2216.

The Medusa leak page states that internal files were stolen. The exact number of people whose data may have been exposed remains unknown. No specific samples of the stolen data have been publicly detailed beyond the confirmation of exfiltration. The incident follows the group’s standard pattern of encrypting systems, demanding payment and then publishing proof of theft when victims do not pay.

Why This Matters for You and Your Family

When a company like Oscars Group suffers a breach, the information taken can include details that connect your name, address, phone number, email or payment records to your everyday activities. If you have visited one of their venues, stayed in their accommodation, used their gaming facilities or attended an event, your information may now sit in a ransomware data set.

Stolen internal files often contain customer databases, booking records, loyalty program details and staff payroll information. Once that material reaches criminal marketplaces, it can be combined with other leaks to build a complete picture of your household. For families this means children’s names, dates of birth or even school-related event bookings can surface alongside adult records, increasing the chance of targeted scams or identity theft.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one company. Criminals use the exposed data to map connections between usernames, email addresses, phone numbers and real-world identities. A single leaked booking reference can link your personal email to a gaming account or a child’s event registration. These chains allow attackers to move from one platform to another, turning a hospitality breach into account takeovers on social media, gaming services or financial apps.

Credential leaks like this one frequently cascade into doxxing. Public reporting shows that once initial data appears on leak sites, follow-on attacks against linked personal accounts rise sharply. Gaming accounts belonging to you or your children are especially vulnerable because the same passwords or recovery emails are often reused across entertainment and booking platforms.

Medusa’s Publicly Known Track Record

Public reporting attributes Medusa with emerging in 2021. The group has targeted organisations across healthcare, education, manufacturing and hospitality. Notable prior victims include schools, hospitals and mid-sized businesses whose data appeared on the same leak site. Their typical playbook begins with initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files, deployment of ransomware encryption and finally extortion via leak-site pressure when ransom demands are ignored.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles and real identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used for Oscars Group bookings or loyalty accounts and enable 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that chain back to the same address or email.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The incident shows that even well-established local companies can become gateways for identity exposure that reaches your front door. Taking deliberate steps now limits how far attackers can travel along the identity chains created by this and future breaches. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts.