Medusa Ransomware Hits Belgian IT Firm Prosolit in Major Data Breach
Medusa Ransomware Group Targets Prosolit in Belgium
Prosolit, a Belgium-based IT services company, has recently fallen victim to a ransomware attack orchestrated by the notorious Medusa group. The attack has resulted in a significant data breach, compromising 13.07 GB of sensitive information.
About Prosolit
Established in 2004, Prosolit specializes in a variety of IT services aimed at enhancing business operations and digital presence. With over 20 years of experience, the company offers tailored solutions in custom software development, e-commerce website creation, IT infrastructure management, and maintenance services. One of their standout offerings is the proprietary Gescom software, a comprehensive commercial management tool designed to streamline business operations.
Company Size and Industry Position
Prosolit is a small to medium-sized enterprise with an estimated annual revenue of approximately $200,000. The company is headquartered in Erpent, Wallonia, Belgium, and has a presence in Urmond, Limburg, Netherlands. Despite its modest size, Prosolit has carved out a niche in the IT services sector by offering a diverse range of services, from custom software solutions to machine park management.
Vulnerabilities and Attack Overview
Prosolit's extensive involvement in custom software development and IT infrastructure management makes it a lucrative target for ransomware groups. The company's reliance on proprietary software and the handling of sensitive client data present significant vulnerabilities. The Medusa group exploited these weaknesses, leading to a substantial data breach.
About the Medusa Ransomware Group
Medusa is a ransomware group that emerged in late 2022 and operates as a Ransomware-as-a-Service (RaaS) platform. The group has been involved in various high-profile attacks across multiple sectors globally. Medusa's ransomware is designed to disable numerous applications and services, making detection and mitigation challenging. The group often demands substantial ransoms, with recent demands ranging from hundreds of thousands to millions of dollars.
Penetration Tactics
While specific details about how Medusa penetrated Prosolit's systems are not publicly available, common tactics include phishing attacks, exploiting unpatched vulnerabilities, and leveraging weak security protocols. Given Prosolit's focus on custom software and IT infrastructure, any lapses in cybersecurity measures could have provided an entry point for the attackers.
Disclaimer
The Halcyon Attacks Lookout Database is compiled using publicly available information based on the hosting choices of real-world threat actors and data from a variety of trackers. This information is provided in accordance with principles of fair use. Halcyon has made reasonable efforts to sanitize and verify the data; however, we do not guarantee the accuracy, completeness, or reliability of the information provided. Updates to the database are made as new source data becomes available from reputable sources. By accessing, viewing, or using the information within the Halcyon Attacks Lookout Database, you acknowledge and agree to do so entirely at your own risk. No reliance should be placed upon the information for decision-making, and Halcyon disclaims all liability for any inaccuracies or omissions in the data.
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!