wellons.org Listed by Medusalocker Ransomware Group

On October 23, 2023, the ransomware group MedusaLocker added wellons.org to its public leak site, stating that it had exfiltrated more than 15 GB of internal files during a ransomware attack. The listing explicitly references employee information, agreements, customer email lists in .xls format, and PST files containing all Outlook messages spanning 2006 to 2023. The group set a $55,000 price for the data.

Primary Disclosure Details

The MedusaLocker leak site listing, preserved via ransomware.live at the onion address provided, states that internal files were taken after the organization failed to meet the group's demands. The disclosure indicates that the data includes employee records, contractual agreements, customer email spreadsheets, and a large archive of Outlook PST files covering nearly two decades of email correspondence. The listing does not quantify the exact number of individuals affected, nor does it provide samples beyond the file-type descriptions. Public reporting on MedusaLocker confirms this matches the group's standard method of publishing victim names and partial proof-of-exfiltration details when ransom is not paid.

Why This Matters for You and Your Family

If you or any member of your family worked with, purchased from, or corresponded with wellons.org at any point in the last seventeen years, your personal or professional email address is likely now in attackers' hands. Customer email lists (.xls) and 17 years of Outlook messages mean names, addresses, phone numbers, and sensitive business or personal discussions may have been exposed. Even if you are not a direct employee, the broad scope of customer and correspondence data creates overlap with ordinary people who simply interacted with the organization. This kind of breach rarely stays contained; once the files leave the leak site they often spread to additional criminal forums where identities are packaged and sold.

Doxxing and Identity-Chain Risks

Employee information combined with long-term email archives gives attackers the raw material to build detailed identity chains. A single work email can link to personal accounts, family member names, home addresses, and even children's details mentioned in correspondence. These chains frequently cascade into gaming accounts, where stolen credentials lead to further doxxing, account takeovers, and harassment. The 15+ GB of data provides ample context for social-engineering attacks tailored to you or your family. Without proactive mapping, one breach can quietly connect dozens of your online handles to your real-world identity.

MedusaLocker's Known Track Record

Public reporting attributes MedusaLocker's first significant campaigns to late 2020. The group has since targeted healthcare providers, municipalities, educational institutions, and small-to-medium businesses across multiple continents. Its typical playbook involves initial access through vulnerable remote desktop protocol servers or phishing, followed by deployment of ransomware that both encrypts systems and exfiltrates data before triggering the demand. When payment is refused, MedusaLocker publishes victim organizations on its leak site with descriptions of stolen material and a ransom price, as seen in the wellons.org case. The group continues to operate under the same name rather than rebranding, maintaining a consistent extortion style focused on data sales when encryption alone fails to produce payment.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you ever used at wellons.org or in emails connected to that domain, then enable 2FA through an authenticator app everywhere that password was reused.
• Cover the household with DoxxScan family protection that extends to dependents and children's gaming accounts, which often become the next link in doxxing chains after credential leaks like this one.
• Let the remediation specialists perform takedown requests across data brokers and leak repositories on your behalf.

The wellons.org listing is a concrete reminder that data stolen in 2023 can expose activity stretching back to 2006, turning one organization's breach into a long-term privacy problem for everyone whose information was stored there. Start your DoxxScan trial today and combine continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage to reduce the risk that this or future leaks translate into identity theft, account takeovers, or targeted harassment for you or your family.