On December 13, 2025, Thunder Bay Counselling appeared on the Medusa ransomware group’s leak site after the organization suffered a ransomware attack that resulted in the exfiltration of internal files containing sensitive personal information.
Watch Thunder Bay Counselling
Get alerted the next time Thunder Bay Counselling files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Thunder Bay Counselling’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates that internal files were exfiltrated during the ransomware incident. Thunder Bay Counselling, a provider of mental health counselling, psychotherapy, workplace support services, and community wellness programs in the Thunder Bay region, serves individuals, families, and local businesses. The precise number of people affected remains unknown at this time. Available reporting describes the data as internal files that would logically include client records given the nature of the organization’s work. The Medusa group listed the victim on its dark-web leak site on December 13, 2025, following standard ransomware tactics of data theft followed by extortion pressure.
Why This Matters for You and Your Family
When a counselling centre is breached, the people most exposed are often those who sought help for deeply personal matters: mental health struggles, substance use, family conflicts, or workplace stress. If you or anyone in your family has used Thunder Bay Counselling services, your private records may now sit on a criminal leak site. This kind of exposure can lead to embarrassment, workplace discrimination, insurance complications, or targeted scams that exploit the very vulnerabilities you were trying to address. Even if you were not a direct client, family members, partners, or dependents listed in shared records can be drawn into the fallout.
The Doxxing and Identity-Chain Implications
Ransomware leaks rarely stop at one database. Criminals frequently cross-reference stolen counselling files with other breached data to build detailed profiles. A phone number from a client intake form can link to an email address used on a gaming account, which then connects to a home address or child’s username. These identity chains allow attackers to move from simple data sales to full doxxing, harassment, or account takeovers. Credential leaks of this nature often cascade into gaming platforms, where children’s accounts become entry points for further targeting of the entire household.