Hathcock (Personal) Listed by medusalocker Ransomware Group

On May 5, 2026, the personal files of Noel Ray Hathcock and Trinity John Hathcock were listed on the leak site of the medusalocker Ransomware Group. The posting, discovered via ransomware.live, contains internal documents described as “comprehensive reports” that were allegedly exfiltrated during a ransomware attack on what appears to be a personal or small-business target.

What's Publicly Reported from Reporting

Public reporting indicates the data was stolen in a ransomware incident and later published on the group’s dark-web leak page. The exposed material consists of internal files rather than a simple database dump. No exact victim count beyond the two named individuals has been confirmed. The leak site lists the entry under the name “Hathcock (Personal),” signaling the target was treated as an individual rather than a large corporation.

Why This Matters for You and Your Family

When personal documents appear on a ransomware leak site, the information can quickly move from criminals to identity thieves, stalkers, or harassers. Names, addresses, financial details, and family connections contained in such reports give attackers concrete material to build profiles on you and everyone living at the same address. For ordinary families this often leads to unexpected phone calls, targeted phishing, or attempts to access bank accounts and government services. Children’s names appearing alongside parents’ information can expose them to long-term risks that surface years later when they apply for their first jobs or loans.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at one leak. Once a name and address are public, attackers cross-reference them with usernames, email addresses, and phone numbers found in earlier breaches. This creates an identity chain that links your online handles to your real-world identity. Credential leaks like this one frequently cascade into account takeovers on email, social media, and gaming platforms. Gaming accounts belonging to children are especially vulnerable because they often reuse passwords or recovery emails tied to the family’s main accounts. The result can be doxxing campaigns that publish home addresses, phone numbers, and photos across forums and social platforms.

Medusalocker’s Publicly Known Track Record

Public reporting attributes the group’s emergence to 2024. It has since listed both corporate and personal targets. Notable prior victims include small businesses and individuals whose sensitive files were published after ransom demands went unpaid. The typical playbook begins with initial access through phishing or exploited remote desktop services, followed by exfiltration of documents, then encryption of systems. If the victim does not pay, the group publishes samples on its leak site and sometimes offers the full archive for sale. Extortion pressure is applied through direct contact and public shaming on the dark web.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the no-subscription cleanup to remove what you can.
• Rotate every password used at the breached service anywhere it is reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that chain back to the same address or recovery details.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts.

The incident shows that ransomware groups now treat ordinary households as viable targets. Acting quickly on credential changes, monitoring, and removal requests can break the identity chain before it grows. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting these steps now limits the damage from leaks that have already occurred and from those that have not yet surfaced.