Serenity Salon & Spa Listed by Medusa Ransomware Group

On February 10, 2025, Serenity Salon & Spa appeared on the Medusa ransomware group’s leak site after its internal files were allegedly exfiltrated during a ransomware attack. The Tucson, Arizona business, which provides hair, skin care, waxing, massage, and nail services, had its corporate data listed publicly. While the exact number of customers affected remains unknown, anyone who visited the salon or whose contact details were stored in its systems could have personal information now at risk.

What Public Reporting Shows

Public reporting indicates the incident involved exfiltration of internal files followed by the traditional ransomware playbook of encryption and public shaming. The Medusa leak page for Serenity Salon & Spa was published on February 10, 2025. The salon operates from 15270 N Oracle Rd Ste B182 in Tucson and employs six people. No specific customer count or detailed list of exposed data types has been released by the company or the attackers. Available reporting describes the breach as part of Medusa’s ongoing campaign targeting small and mid-sized businesses across the United States.

Why This Matters for You and Your Family

When a local business like a salon suffers a breach, the information exposed often includes names, addresses, phone numbers, email addresses, dates of service, and sometimes payment details. If you or your family members have ever received services there, those records can be used to build a profile that makes you easier to target for identity theft, phishing, or physical scams. Even a single salon visit can link your real identity to other online accounts if the same email or phone number appears in multiple breaches. For families, this risk extends to children whose names or medical details might appear in appointment records.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one company’s files. Attackers and opportunistic criminals scan the dumped data for email addresses, usernames, and phone numbers, then cross-reference them across other breaches. This creates an identity chain that can reveal where you live, where your children go to school, and which gaming accounts are tied to the same household. Credential leaks like this one frequently cascade into account takeovers on social media, email, and gaming platforms. Once initial details surface, doxxing escalates quickly as criminals link handles to real identities and sell or publish the full picture.