> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Medusalocker leaks operational data from South African courier The Courier Guy - URL: https://f4n6.co.uk/security-feed/medusalocker-leaks-operational-data-from-south-african-courier-the-courier-guy/ - Published: 2026-11-05T09:35:50.000Z - Updated: 2026-11-05T09:35:50.000Z - Author: Jeff Davies - Tags: #security-feed, MedusaLocker ## 1\. Executive summary On 2026-11-04 the extortion group operating as medusalocker listed The Courier Guy, a South African courier company, on its leak site and posted what it describes as operational documents: purchase orders to suppliers, staff recruitment and training records, leave schedules, shopping-centre lease renewals, security SLAs and vehicle finance documents. The listing is the operator's own claim. No source states how access was obtained, when the data was taken, how much was taken, or whether The Courier Guy has confirmed the breach. Medusalocker has no MITRE ATT&CK profile, so the group name is unconfirmed as an attribution and no actor profile can be attached to it. For EMEA financial services the direct exposure is low unless a client holds a supplier, logistics, payment or financing relationship with The Courier Guy; the material described (purchase orders, lease and finance documents, security SLAs) is the kind of supplier paperwork that carries bank details, signatory names and contract terms, so any client with such a relationship should treat its own contract data as potentially exposed. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. ## 3\. Technical analysis & attack chain The listing establishes one thing: an operator using the name medusalocker claims to hold documents from The Courier Guy and has published a sample of them on its leak site. It does not establish the access vector, the dwell time, the volume of data taken, the date of exfiltration, or that The Courier Guy has acknowledged the incident. No source names a vulnerability, a CVE, a malware family, a tool or an initial-access route. No attack chain can be written from confirmed steps because none are reported. What the operator says the dump contains is specific enough to be worth recording. The categories named are purchase orders to suppliers, staff recruitment and training records, leave schedules, lease renewals for shopping-centre premises at Wonderpark, South Coast Mall and Growthpoint The Avenues, security SLAs, and vehicle finance documents. That mix is back-office and commercial paperwork rather than customer or payment-card data. Purchase orders and lease and finance documents routinely carry banking details, authorised signatories, VAT and company registration numbers and contract values. Security SLAs describe guarding, alarm and response arrangements. Staff records carry identity and employment data. None of this is confirmed by The Courier Guy, and the operator has an interest in overstating what it holds. A separate page on the same leak-site index for this victim shows figures attributed to a third-party intelligence feed: 24 compromised employees, 2,746 compromised users, 36 third-party employee credentials and an external attack surface count of 25\. Those figures are not explained on the page, are not attributed to medusalocker, and no source links them to the access used in this incident. They are recorded here so the reader knows they exist and should not be treated as findings about this breach. Adverse Trace assesses, on the document categories alone, that the more consequential exposure is commercial rather than technical: supplier bank-detail and contract data that could support invoice fraud or social engineering against The Courier Guy's counterparties. That assessment rests only on the document types the operator names and is not corroborated by any second source. ## 4\. Mitigation & containment P1 (within 24h): identify any live supplier, logistics, cash-in-transit, vehicle finance or premises relationship with The Courier Guy and confirm with the relationship owner whether contract, purchase-order or bank-detail data has been exchanged in the last 24 months. Where bank details for The Courier Guy appear in your supplier master, re-verify them by callback to a number already on file, not to a number taken from any document or email, before the next payment run. P1 (within 24h): brief accounts payable and procurement on the document categories named in the listing. Any inbound change of bank details, remittance instruction or contract amendment purporting to come from The Courier Guy should be treated as suspect until verified by callback. P2 (within 72h): if your organisation holds security SLA or guarding arrangements with The Courier Guy, ask the account contact whether site security schedules, alarm codes or response procedures were held in the affected systems, and whether those arrangements need to be re-issued. P2 (within 72h): search email and file stores for correspondence containing the premises names in the listing (Wonderpark, South Coast Mall, Growthpoint The Avenues) and for purchase orders or lease documents referencing The Courier Guy, to establish what of your own data sits in the counterparty's records. P3 (within 7 days): add the leak-site victim page to monitoring so that further publications attributed to this listing are picked up, and record the outcome of the supplier verification in the third-party risk register. No fixed release, patch or vendor advisory is named in public reporting for this item, because no vulnerability is identified. There is no technical control to apply to The Courier Guy's estate from outside; the actions above are supplier-relationship and payment-verification controls. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources give no file hashes, domains, IP addresses, file paths, registry keys or command lines tied to this incident. The leak-site URL is a public indexing page, not an indicator, and is cited in §7 only. ## 6\. Detection Insufficient indicators to author detection rules. ## 7\. Sources - ransomware.live, "Ransomware: medusalocker named The Courier Guy (ZA)", https://www.ransomware.live/id/VGhlIENvdXJpZXIgR3V5QG1lZHVzYWxvY2tlcg==, published 2026-11-04. - ransomware.live, "Victim: The Courier Guy – medusalocker" (victim index page, same URL as above), https://www.ransomware.live/id/VGhlIENvdXJpZXIgR3V5QG1lZHVzYWxvY2tlcg==. Both sources are the same leak-site index entry. Every fact in this advisory about the victim, the operator's claim and the document categories is single-sourced to that index. Nothing here is corroborated by The Courier Guy, by a national authority or by a second independent reporting outlet. ## 8\. Adverse Trace position Adverse Trace assesses this as a low-severity item for EMEA financial services clients. It is a single leak-site listing of a non-financial victim, with no stated access vector, no confirmed data volume, no victim confirmation and no stated link to financial services. The group name medusalocker has no MITRE ATT&CK profile, so the attribution is unconfirmed and we do not attach an actor profile to it. The claim rests on one index source and should be treated as an operator assertion until The Courier Guy or a national authority confirms it. Clients with a direct supplier, logistics, vehicle finance or premises relationship with The Courier Guy should complete the P1 payment-verification and supplier callback steps in §4 and report the outcome to us. We will monitor the leak site for further publications under this listing and re-issue this advisory if The Courier Guy confirms the incident, if a second independent source corroborates the data categories, or if any client relationship to the victim is established. --- [Read the original source →](https://www.ransomware.live/id/VGhlIENvdXJpZXIgR3V5QG1lZHVzYWxvY2tlcg==?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*