SHAMASS.ORG Listed by Medusalocker Ransomware Group

On April 22, 2024, the ransomware group MedusaLocker added shamass.org to its public leak site, listing internal files exfiltrated during a ransomware attack. The listing includes employee information, agreements, customer emails in .xls format, and .msg Outlook files. The group is demanding $50,000 and claims the files contain additional profit-making opportunities for any buyer.

Details in the Leak-Site Listing

The MedusaLocker leak page states that shamass.org suffered a ransomware intrusion in which attackers exfiltrated internal documents before encrypting systems. The disclosure does not specify the total number of records affected, the exact date of initial compromise, or the volume of data taken. It simply presents samples of the stolen material and sets a $50,000 price for the full archive, noting that “options for making a profit from these files will be included in the deal.” No victim notification or regulatory filing has yet surfaced publicly, so the precise scope remains unconfirmed by the organization itself.

Why This Matters for You and Your Family

When a nonprofit or community organization like shamass.org is breached, the people whose names, emails, and correspondence appear in those spreadsheets and Outlook messages face direct exposure. Customer email lists and employee agreements often contain home addresses, phone numbers, dates of birth, and financial details that identity thieves can weaponize. If your information was stored by this organization, the breach means threat actors now hold fresh, verified data that can be cross-referenced with other leaks to build complete profiles of you and your household.

Doxxing and Identity-Chain Risks

Leaked employee and customer records rarely stay isolated. A single .xls file can link your work email to personal phone numbers, which in turn connect to social-media handles, gaming accounts, and family-member details. Attackers automate these linkages, creating doxxing chains that lead to harassment, SIM-swapping, or targeted phishing. Credential leaks of this nature frequently cascade into account takeovers on gaming platforms, where children’s usernames and shared family passwords become entry points for further compromise.

MedusaLocker’s Known Track Record

Public reporting attributes MedusaLocker’s first appearances to late 2020. The group has since hit hospitals, schools, municipalities, and smaller nonprofits across multiple continents. Its typical playbook involves gaining initial access through vulnerable remote desktop protocol servers or phishing, followed by aggressive data exfiltration and deployment of ransomware that also wipes backup systems. After encryption, the operators wait a short period before publishing samples on their Tor leak site and simultaneously offering the full dataset for sale to third parties. This dual extortion model—ransom from the victim plus auction to data brokers—has become a signature tactic.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to scrub what appears.
• Rotate any password you ever used at shamass.org or similar organizations and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same leaked address or email.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf.

The incident underscores how quickly nonprofit data leaks turn into long-term identity risks for ordinary families. Start your DoxxScan trial today; its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage—including children’s gaming accounts—give you the fastest path to containment and recovery. Source: MedusaLocker leak site via ransomware.live