World Vision Perú Listed by Medusa Ransomware Group

On October 11, 2024, the ransomware group Medusa added World Vision Perú to its public leak site, claiming that internal files had been exfiltrated from the Christian social-action organization during a ransomware attack. The listing affects anyone whose personal information appears in those files, including potentially employees, donors, partner organizations, and the vulnerable families and children the nonprofit serves across Peru.

Details from the Medusa Listing

The Medusa leak site states that World Vision Perú suffered a ransomware intrusion and that attackers successfully exfiltrated internal files. The disclosure does not quantify the number of records involved, list specific data types exposed, or provide a ransom demand. It simply states that data was taken and is now held by the group. The organization, founded in 1994 and headquartered in Lima, employs 314 people and focuses on child protection and community development programs. No further technical details about the initial access vector or the precise systems compromised have been released in the primary disclosure.

Why This Matters for You and Your Family

When a nonprofit like World Vision Perú is breached, the people most at risk are often those least expecting it: local staff, volunteers, donors who provided identification for tax receipts, and families who received aid. Internal files frequently contain names, addresses, national identification numbers, dates of birth, contact details, banking information for payroll or grants, and sensitive case notes about children and at-risk households. Once that information leaves the organization’s control, it can be used for identity theft, targeted fraud, or sold on underground markets. Even if you are not an employee, if you or your child ever participated in a World Vision program in Peru, your information may now be in the hands of criminals.

The Doxxing and Identity-Chain Risk

Exfiltrated internal files rarely contain isolated records. They create long identity chains that link an email address to a physical address, a phone number to a child’s name, or a donor ID to family relationships. Attackers and subsequent buyers can combine this data with other breaches to build detailed profiles. These chains often extend into gaming accounts, where children use the same email or password they or their parents used for nonprofit registrations. A single leaked record can therefore lead to account takeovers on Steam, Roblox, or Discord, exposing chat logs, location data, and further personal details that fuel harassment or additional extortion. Credential leaks like this one cascade quickly into doxxing campaigns that affect entire households.

Medusa’s Known Track Record

Public reporting attributes Medusa with emerging in 2021 as a ransomware-as-a-service operation that targets organizations worldwide. The group is known for double-extortion tactics: encrypting victim systems while simultaneously exfiltrating data and then threatening to publish it unless a ransom is paid. Notable prior victims have included healthcare providers, educational institutions, and nonprofits. Medusa typically gains initial access through compromised credentials or vulnerable remote desktop services, exfiltrates data quietly, deploys its encryptor, and later posts samples or full datasets on its onion leak site when negotiations fail. The group maintains an active leak portal and frequently updates it with new victims, applying steady pressure through countdown timers and proof-of-compromise samples.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including any nonprofit or aid-program registrations that may now be exposed.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Rotate any password you used with World Vision Perú or related services anywhere it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same breached email or address.
• Let remediation specialists handle takedown requests for any exposed personal documents or broker listings that appear after this incident.

The Medusa listing of World Vision Perú is a reminder that even organizations dedicated to protecting children can become gateways for identity compromise. Acting quickly on the information now available can limit how far the breach travels. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage including children’s gaming accounts give families a practical way to stay ahead of these cascading risks.