Medusa Extorts Bell Ambulance with 210GB Data

• The Medusa ransomware group has been extorting an emergency service provider based in the United States of America.
• Bell Ambulance, Inc. was named as a data breach victim by the threat actors recently.
• Medusa gave a deadline of 7 days to respond to their data leak threat. 

The Medusa ransomware group has claimed responsibility for targeting a U.S.-based emergency and non-emergency medical services company. The group named Bell Ambulance, Inc. on the dark web and placed a deadline of 7 days for ransom payment.

They exfiltrated 210.50GB of data allegedly from the ambulance service provider and posted about it on March 2, 2025. 

The dark web ransomware claim had received 26 views at the time it was shared by the threat intelligence platform, FalconFeeds on March 3rd. 

We approached the company with the threat intelligence post about Medusa’s claim. We will update this report after receiving a response.

Bell Ambulance, Inc. has been operating since 1977 and offers 82 ambulances for Basic Life Support (BLS) emergency and non-emergency 911 services. They also offer services for ALS Paramedic emergencies and the Children’s Wisconsin Critical Care Transport Team. 

Bell Ambulance has over 700 employees and annually receives over 120,000 calls.

The company has not made any announcements mentioning a security incident on its website. Nor has there been any update about services being disrupted. 

The Medusa group has been naming targeted companies on the dark web and trying to extort them with stolen information. Among the recently named companies were Mundelein Park & Recreation District, Laurens County School District 56, Heartland Health Center Inc, and Aurora Broadworks.

Medusa gave a deadline of 14 to 11 days for ransom payment to the U.S.-based companies which included educational and healthcare service providers.

The targeting pattern of Medusa points toward desperation in extorting victims and exploiting vulnerable sectors that could be pressured into ransom payment keeping their services in mind.