Aldagi Listed by Medusa Ransomware Group

On August 26, 2025, Georgian insurance company Aldagi appeared on the leak site of the Medusa ransomware group, with the attackers claiming to have exfiltrated internal files from the firm that has provided auto, property, life, health, and other insurance products to individuals and businesses in Georgia since 1990.

Reported Details of the Incident

Public reporting indicates that Aldagi, which employs more than 500 people and launched its own reinsurance arm in 2022, was listed by the Medusa group. The attackers posted proof of access and stated they had taken internal company files. No specific volume of stolen data or exact number of customer records has been publicly confirmed. The listing appeared on the group’s dark-web leak site, a common tactic used to pressure victims into payment.

Internal files were the primary data type referenced. Available reporting describes the incident as a ransomware attack involving both encryption and data exfiltration, though the precise systems compromised have not been detailed in public sources.

Why This Matters for You and Your Family

When an insurance company suffers a breach, the information at risk often includes personal details you provided when buying policies for your home, car, health, or travel. Names, addresses, dates of birth, policy numbers, and sometimes banking information or medical details can appear in leaked files. For your family this can mean increased risk of identity theft, fraudulent claims filed in your name, or targeted scams that reference your real insurance history.

Insurance customers are frequent targets because their data tends to be detailed and long-lived. A single breach can expose years of records for thousands of households. Even if the exact number of affected Aldagi customers remains unknown, the incident underscores how data you share with everyday service providers can suddenly surface on criminal marketplaces.

The Doxxing and Identity-Chain Risks

Stolen insurance files frequently contain email addresses, phone numbers, and home addresses that attackers can chain together with other leaked credentials. Once criminals link your insurance records to gaming accounts, social-media handles, or family-member profiles, they can launch doxxing campaigns that publish your full identity online. Credential leaks like this one regularly cascade into account takeovers, especially for gaming platforms used by children, where the same email or password may have been reused.

These identity chains grow quickly. A phone number from an insurance database can be matched to a child’s gaming username, leading to harassment, swatting, or further extortion. What begins as a corporate ransomware incident can become a personal privacy nightmare for you and your family within weeks.

Medusa Group’s Known Track Record

Public reporting attributes Medusa’s emergence to 2022. The group has targeted organizations across multiple countries with a double-extortion playbook: encrypting victim systems while simultaneously exfiltrating data, then threatening to publish the files unless a ransom is paid. Notable prior victims include healthcare providers, manufacturers, and other insurers, though exact details vary by incident. Their typical approach involves initial access through phishing or exploited vulnerabilities, followed by lateral movement inside networks to locate sensitive files before triggering the ransomware.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used on Aldagi or any related insurance portal anywhere else it is reused, and switch on 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught and addressed in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and emails stolen in incidents like this.
• Let remediation specialists handle takedown requests for any exposed personal records that appear on data-broker or doxxing sites.

The Aldagi breach is a reminder that insurance companies hold some of the most intimate details about your daily life and your children’s futures. Taking concrete steps now can limit how far this leak travels. DoxxScan by GalaxyWarden offers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information before criminals stitch it into larger attacks.