Dian Colombia Ransomware Claim by MedusaLocker (Nov 2026)

Claim Summary

On or around November 4, 2026, the ransomware group tracked as MedusaLocker allegedly posted Dian (dian.gov.co), a Colombian government entity, to its dark web leak site. According to the threat actor, the group extracted 339 email addresses from the organization and lists the attack date as November 4, 2026. The claimed data volume is undisclosed. Dian is listed with a Colombian (CO) country tag; the industry field was not populated in the leak site entry.

This report is based solely on the unverified leak site listing. Yazoul Security has not independently confirmed that any intrusion occurred, that data was exfiltrated, or that the posted details are accurate.

Threat Actor Profile

The claim is attributed to medusalocker, a ransomware operation with limited publicly documented tradecraft. At the time of writing, our tracking shows an unknown total victim count, no confirmed tooling profile, and no public research references specific to this group. That absence of a documented track record is itself a credibility signal: we cannot corroborate the group’s operational maturity, prior successful extortion campaigns, or technical capability.

Because no known tools or tactics are publicly attributed to MedusaLocker, defenders should not assume a specific initial access vector, encryption routine, or exfiltration method. Treat the group as uncharacterized until independent reporting or incident response evidence emerges. No YARA rules or detection guidance specific to this actor are currently available in our intelligence holdings; generic ransomware detection (behavioral monitoring for mass file modification, shadow copy deletion, and unusual outbound transfer) remains the practical baseline.

Alleged Data Exposure

The threat actor claims to have extracted 339 email addresses. That is a small, low-specificity data set. Email addresses alone are frequently scraped from public sources, harvested from marketing lists, or assembled from prior breaches, and they are not strong evidence of a network intrusion. The group has not, according to the listing, disclosed a data volume, provided samples, or described the nature of the allegedly exfiltrated material.

We are deliberately not reproducing any samples, credentials, or access details, and none were provided in the source listing. The claim of “339 emails extracted” should be read as an assertion by the threat actor, not a verified finding.

Potential Impact

If the claim is accurate, the exposure of email addresses could enable targeted phishing or business email compromise attempts against Dian personnel and contacts. For a government tax and customs authority, even limited contact data can be leveraged for social engineering. However, given the low specificity of the alleged data and the group’s undocumented history, the practical impact may be far smaller than the leak site post implies. Ransomware groups routinely exaggerate scope and inflate victim counts to pressure targets into paying.

What to Watch For

• Official statements from Dian or Colombian authorities confirming or denying an incident.
• Any independent incident response reporting or regulatory disclosure.
• Follow-on phishing referencing Dian or Colombian tax matters.
• Whether MedusaLocker publishes samples or escalates its claim - a common pressure tactic.
• Corroborating evidence of the group’s tooling from other victim disclosures.

Disclaimer

This report concerns an unverified claim published on a ransomware leak site. Nothing here is confirmed. Yazoul Security has not independently validated the intrusion, the data theft, the victim identity, or the accuracy of any detail attributed to the threat actor. All statements reflect the group’s own assertions and should be treated with skepticism. Organizations should rely on their own forensic investigation and official disclosures before drawing conclusions.