Cyber Incident Victim: Royal Brighton Yacht Club
Date:
Jun 2024
Location:
Australia
Summary
The Royal Brighton Yacht Club suffered a Medusa ransomware attack via a compromised third-party point-of-sale remote support tool, resulting in system encryption and theft of over 94GB of data. Exfiltrated information included member and employee personal details, financial records, internal emails, and supplier login credentials with plaintext passwords, later published on the dark web. The club engaged cybersecurity experts to contain the breach, restore systems, and notify affected individuals while cooperating with the Australian Cyber Security Centre. Medusa demanded a $100,000 ransom with an eight-day deadline. This incident followed the gang's prior leak of security footage from another Australian institution.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On July 1, 2024, Victoria’s Royal Brighton Yacht Club (RBYC) confirmed it fell victim to a ransomware attack by the Medusa gang, which publicly claimed responsibility by posting stolen data on its darknet leak site. The attackers exfiltrated over 94 gigabytes of data, including sensitive personal information of members and employees, financial records, internal documents, and login credentials for external suppliers. RBYC General Manager Philip Hall attributed the breach to a "sophisticated supply chain cyber attack," specifically citing compromise of a third-party point-of-sale (POS) system’s remote support tool as the intrusion vector. Medusa deployed ransomware that encrypted the club’s systems, though RBYC detected the activity promptly and initiated containment measures. The club engaged a cybersecurity partner to manage incident response and restoration efforts, isolating affected systems to minimize operational disruption.
The published data samples revealed member names, addresses, phone numbers, membership fee details, employee superannuation information, contact details, internal emails, and supplier login credentials with plaintext passwords. Medusa set a ransom deadline of eight days, demanding $100,000 for undisclosed actions, though RBYC did not confirm whether payment was considered. The Australian Cyber Security Centre (ACSC) was notified, with the club cooperating fully in their investigation. Impacted individuals were being notified as of the confirmation date, with Hall acknowledging the breach’s severity and committing to enhanced security protocols. The incident followed Medusa’s prior attack on Perth’s Harry Perkins Institute of Medical Research, which involved leaking terabytes of security footage. RBYC emphasized restoring stakeholder trust while maintaining operational continuity throughout remediation.