dulay.ca Listed by medusalocker Ransomware Group

On November 17, 2025, the Canadian web development firm dulay.ca appeared on the leak site of the medusalocker ransomware group with 500 GB of internal files offered for sale at a $40,000 price.

What's Publicly Reported from Reporting

Public reporting indicates the company suffered a ransomware attack in which attackers exfiltrated internal files before encrypting systems. The medusalocker leak page lists the victim with a download link and notes that options for profiting from the files are included in any sale. No confirmed count of individuals whose personal information is contained in the files has been released. The exposed data consists of internal documents rather than a structured database of customer records, though such documents frequently contain names, contact details, contracts, and other sensitive business information that can be repurposed.

The incident follows the group’s typical pattern of posting proof of compromise and giving victims a short window to negotiate before broader distribution or auction of the stolen data.

Why This Matters for You and Your Family

When a company that has handled your website, email setup, or online projects is breached, your personal or family information may be sitting inside the stolen files. Names, addresses, phone numbers, and email accounts are common in web-development records. Once those details leave the company’s control, they can be sold quietly on underground forums and used to target you directly.

Even if you never signed a contract yourself, shared family projects, children’s school sites, or small-business sites built by the same firm can pull your household into the exposure. The 500 GB volume suggests a large amount of unstructured data that could link multiple clients together.

The Doxxing and Identity-Chain Risk

Stolen internal files often contain more than names and emails. They can include admin usernames, old passwords, API keys, client notes, and references to personal accounts. Attackers combine these fragments with data from earlier breaches to build an identity chain that leads from an anonymous gaming handle or social-media profile back to your real name and home address.

Credential leaks like this one cascade into account takeovers and doxxing chains, especially when gaming accounts belonging to you or your children reuse the same email or password. A single exposed contract or support ticket can give attackers the extra context they need to impersonate you, reset other accounts, or publish your family’s information online.

MedusaLocker’s Publicly Known Track Record

Public reporting attributes the group’s emergence to 2021. Since then it has targeted organizations across North America and Europe, including healthcare providers, manufacturers, and professional-services firms. Its standard playbook involves initial access through phishing or exploited remote-desktop services, followed by exfiltration of sensitive files, deployment of ransomware to encrypt systems, and later publication of samples on its leak site when victims refuse to pay. The group typically demands payment in cryptocurrency and offers “proof” packages or profit-sharing deals to potential buyers of the stolen data.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with no-subscription cleanup handled by the service.
• Rotate any password you used at dulay.ca anywhere else it appears, then enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that chain back to the same address or email.
• Let remediation specialists perform hands-on takedown requests across data brokers and leak sites on your behalf.

The breach of dulay.ca is a reminder that even routine service providers hold pieces of your digital life that can be turned against you. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting that process promptly can prevent today’s leaked files from becoming tomorrow’s identity theft or harassment.