The East Baton Rouge Sheriff's Office (EBRSO) in Louisiana has confirmed that an international ransomware group broke into its network. In its statement, the office says the attackers only captured screenshots of files and folders and still images taken from video files, and that it stopped them before they got far into the network. Local researchers do not accept that account. According to WBRZ, the Medusa ransomware group has posted a sample of the stolen material on its dark web leak site. It is claiming roughly 93 gigabytes of data, including employee salary lists, inmate mugshots, driver's licenses and CCTV footage from inside the parish prison. WBRZ also reports that Medusa is demanding $300,000 and has given the sheriff's office eight days to pay before it publishes everything.
What Happened
The sheriff's office says outsiders got into its systems and were contained quickly. It describes the exposure as limited to screenshots of folder contents and still frames from video. It has not said publicly how the attackers got in, when the intrusion began, or how long they had access.
Tammy Baker of New Orleans and Southeast Information and Technology, speaking to WBRZ, said she found the listing while monitoring dark web leak sites. The word "parish," which is particular to Louisiana, caught her attention. Medusa then released a sample of the material.
The two accounts disagree. The sheriff's office says the attackers did not take full files. Baker told WBRZ she thinks the office is "in a little bit of denial," and that Medusa "is not known for bragging about exploits that they haven't been successful at." She called it "extremely unlikely" that the group got only partial material. No independent forensic finding has been published that settles the question, and the sheriff's office has not answered the 93 GB figure in public.
A second WBRZ report, carrying comments from Eric Romero, the Department of Homeland Security's Director of Information Technology, describes the incident as having exposed "many highly-confidential employee documents on the dark web." That wording also goes further than the sheriff's office's own description.
What Was Taken
The sheriff's office describes the stolen material as:
- Screenshots of files and folders
- Still images taken from video files
Medusa claims much more, according to WBRZ:
- About 93 GB of data
- Employee salary lists
- Mugshots of people in custody
- Driver's license images
- CCTV footage from inside the prison
The sheriff's office has not confirmed the 93 GB volume or the categories in this list. Even the narrower version is sensitive. Screenshots of folder structures and frames from jail surveillance video can show internal layout, camera coverage, staff identities and case details. Driver's license images and payroll records, if Medusa's claim is accurate, would put employees at direct risk of identity fraud. For law enforcement staff, they could also lead to doxxing and targeted harassment.
Why It Matters
Law enforcement data is especially attractive to extortion groups. A sheriff's office holds personnel files, detainee records and surveillance footage that can endanger officers, inmates and witnesses if leaked. That gives the attackers leverage. A $300,000 demand is small next to corporate ransoms, and it looks sized to what a local government could actually pay.
Leak sites settle disputed claims, and fast. This case shows a familiar pattern. The victim describes a limited intrusion, and the extortion group responds by publishing samples. Once a sample is out, public credibility depends on whether the victim's account matches what researchers can see. Organisations that issue narrow statements before forensics is complete risk being contradicted in public within days.
Medusa is a well-funded criminal operation. Edmond Major, a local cybersecurity researcher, told WBRZ that Medusa is based in Russia and takes ransom in Bitcoin and other cryptocurrency, which makes the people behind it hard to trace. He estimated that groups like it make "tens of millions, if not hundreds of millions of dollars a year." Those are one researcher's estimates, not official figures. Medusa has a long record of attacks on schools, hospitals and local governments, and CISA and the FBI published a joint advisory on the group in March 2025.
Local residents feel the effect beyond the agency itself. WBRZ reported the sheriff's office breach alongside other recent breach notices that reached Baton Rouge residents. Homeland Security officials used the coverage to urge the public to take precautions, because data that has been published "is going to remain out on the web," Romero said.
The Attack Technique
The sheriff's office has not disclosed how the attackers got in, and no incident report or regulator filing has been published.
Without those details, the context comes from public comments and from Medusa's known pattern:
- Phishing. Romero told WBRZ that phishing emails are currently "the biggest threat," and that attackers have become skilled at writing messages that look like they come from a known, trusted contact. This was a general warning. He did not say it was how the sheriff's office was breached.
- Medusa's usual playbook. Public reporting on Medusa describes two common ways in: phishing for credentials and exploiting unpatched internet-facing systems. After that, the group typically uses legitimate remote administration tools to move through the network, then steals data before encrypting it. That gives it two kinds of leverage: systems that won't run, and a threat to publish what it took.
- Double extortion. The public countdown and the posted sample fit the leak-site model. The group steals first and uses publication as the main pressure, whether or not encryption succeeds.
If the sheriff's office really stopped the attackers early, as it says, the theft of 93 GB that Medusa claims would mean data left the network before anyone detected the intrusion. Defenders should plan for that gap between when data is stolen and when the attack is noticed.
What Organizations Should Do
- Train staff to spot phishing, and back it with phishing-resistant MFA. Following Romero's warning, train staff to check unexpected messages that appear to come from familiar contacts. Make sure stolen credentials alone cannot open email, VPN or remote access.
- Patch and reduce internet-facing systems. Medusa and similar groups routinely exploit exposed, unpatched services. Keep an inventory of everything reachable from the internet, close what isn't needed, and patch the rest on a fixed schedule.
- Restrict and monitor remote administration tools. Allow only approved remote access software. Alert on new installs or unusual use, because ransomware crews rely on legitimate tools to blend in.
- Watch for large outbound transfers. Set baselines and alerts for unusual data leaving the network, especially from file servers, HR systems and video management platforms. Theft of tens of gigabytes should not go unnoticed.
- Separate and lock down your most sensitive records. Keep personnel files, ID scans, detainee records and CCTV archives on separate network segments, with strict access controls and logging. Apply this especially in law enforcement and corrections.
- Hold public statements until forensics supports them. Prepare breach communications that say what is confirmed and what is still under investigation. Monitor leak sites yourself, or through a threat intelligence provider, so the first time you see a sample isn't on the evening news. Offer affected employees fraud protection and credit monitoring early, as DHS officials advised.
Sources: EBRSO in ongoing battle with international ransomware group followi... | After capitol region faces two cyber attacks, Homeland Security urg... | U.S. Data Security Crisis Deepens Amid FBI and Pentagon Breaches –... | Major data breaches: where to find official notices | Tradier Brokerage data breach: 98,844 people affected (2026) cison... | Data, on the House The Breach Brief | The Escalation Chain and the Authority Puzzle Zerot Security Research | CISA advisory: how attackers steal company email Oktsec