Natures Organics

Summary

Australian organic goods producer Natures Organics confirmed it fell victim to the Medusa ransomware-as-a-service operation, which listed the company on its darknet leak site and claimed to have exfiltrated roughly 143 gigabytes of data. The threat actors published sample evidence including employee passport and driver's licence scans, bank account transaction histories, internal communications, confidentiality agreements, and payslips, and demanded US$150,000 to publish or delete the stolen data, or US$10,000 to extend the ransom deadline. The company stated it became aware of the incident and notified staff and relevant government authorities, while asserting that clients were not impacted. Medusa is known for using living-off-the-land techniques and legitimate remote management tools to evade detection, move laterally, and disable endpoint defences such as Microsoft Defender.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Natures Organics, an Australian manufacturer of sustainable household goods, was confirmed as a victim of the Medusa ransomware group after the operation listed the company on its darknet leak site on or around 30 January 2025. The Medusa operation is a ransomware-as-a-service group that claims to have exfiltrated 142.85 gigabytes of data from Natures Organics, a haul it described in a file listing that amounted to more than 47,000 lines of data. As proof of the intrusion, Medusa published several documents and files that it alleged were taken from the company, including passport and driver's licence scans belonging to employees, bank account transaction histories, confidentiality agreements, internal communications, and employee payslips. Medusa set a ransom deadline of eight days from publication, offering to publish the stolen data, sell it outright, or arrange its deletion for US$150,000, with an option to extend the deadline for an additional US$10,000.

Natures Organics publicly confirmed the incident on 30 January 2025, the same date it said it first became aware of the breach. A spokesperson for the company stated that it had notified the relevant parties, including staff and government authorities, and that "appropriate action" had been taken in response to the incident. The spokesperson also emphasised that Natures Organics' clients had not been impacted by the breach. The company produces a range of well-known Australian brands, including Earth Choice, My Soda, Purity, and Funtime, and its retail partners include Coles and Chemist Warehouse. Beyond its commercial operations, Natures Organics also supports several overseas non-governmental organisations, including the School of St Jude in Tanzania and the Cambodian Children's Fund, and the company employs more than 140 team members across its Australian office, field, and manufacturing operations.

The Medusa ransomware group employs living-off-the-land techniques, using legitimate software tools to carry out malicious activity in a manner that mimics normal network behaviour, making detection more difficult. The group is known to evade security teams and maintain persistence in victim networks after initial discovery, using remote management and monitoring tools to remotely execute payloads and install vulnerable drivers that can impair defences, including shutting down security software such as Microsoft Defender. Medusa actors also move laterally across compromised networks by modifying registry keys and creating scheduled tasks. Natures Organics was not the only Australian company targeted by Medusa during this period, with the group also listing North Sydney-based Compass Group in September 2024 and ARDEX Australia on 31 January 2025 as victims on its leak site.

The personal information exposed in the Natures Organics incident, including scanned identity documents belonging to employees and internal financial and personnel records, indicated that the attackers had gained deep access to internal systems. The publication of bank account transaction histories and employee payslips suggested that both human resources and financial systems were within the scope of the data theft. The inclusion of confidentiality agreements and internal communications further pointed to access to corporate document repositories. No client or customer data was reported as compromised in the company's public statement on the matter.

Sources

Sources available to members: 1 source.