The MedusaLocker ransomware group has published internal documents it says it stole from The Courier Guy, which MyBroadband describes as South Africa's most popular courier company. The leak follows a breach claim first made in August. At that point the group offered the data for sale at R493,400 (about $30,000, according to MyBroadband). The documents went up on the group's leak site around 4 November 2026. They reportedly cover supplier purchase orders, staff records, financial information and property leases. The data's origin is still disputed. In August, The Courier Guy said it had no evidence that its internal systems had been compromised and that no customer data was involved. The company has not publicly withdrawn that position, and no breach notification to South Africa's Information Regulator has been made public.
What Happened
Accounts differ on when this started. MyBroadband reports that MedusaLocker first listed The Courier Guy on its dark web leak site in August 2026. The group claimed it had got into the company's systems and taken emails. As proof, it published a long list of file names, but the files themselves were locked from view. Cyfenced, HookPhish and the f4n6 security feed all date the listing to 4 November 2026. That is probably when the files were actually posted, not when the claim was first made. Cyfenced, which tracks leak-site posts through Ransomware.live, says it found no statement from the company and no press coverage. That is wrong: MyBroadband had published the company's response in August.
In that August statement, The Courier Guy told MyBroadband: "From what we've been able to review of the material referenced, we are confident that no customer data is involved or has been breached." It said it was investigating as a priority and was "confident in the core system security measures." It had not notified the Information Regulator because it had no sign that a breach had happened. It said it would follow the notification process under South Africa's data protection law (POPIA) if its investigation found otherwise.
The asking price stands out. MyBroadband notes that a fixed sale price suggests this may not have been a standard double-extortion attack, where data is stolen and a ransom demanded. MedusaLocker may instead have taken the data purely to sell it to other criminals, without ever contacting the company. If so, ransomware may never have been deployed. That could explain why The Courier Guy found no sign of an intrusion. This is MyBroadband's theory and has not been confirmed.
What Was Taken
No one has published a volume figure. No record count, file count or dataset size appears in any public reporting. HookPhish and the f4n6 feed describe the dump as operational material:
- Purchase orders to suppliers
- Staff recruitment and training records
- Staff leave schedules
- Lease renewals for shopping-centre premises. HookPhish names Wonderpark, South Coast Mall and Growthpoint The Avenues.
- Security service-level agreements
- Vehicle finance documents
MyBroadband separately describes financial information and details on partners and employees, plus the emails the group says it took. All of these descriptions are consistent. None of them mention customer records, which matches the company's August position. The employee material is still personal information under POPIA. Supplier, lease and finance paperwork usually contains bank details, signatory names and contract terms, which fraudsters can use to impersonate suppliers or redirect invoice payments.
Why It Matters
The direct risk to customers looks limited for now. The bigger risk falls on the businesses around The Courier Guy. Landlords, security contractors, vehicle financiers and suppliers named in leaked contracts are obvious targets for invoice fraud and payment-redirection scams. As the f4n6 analysis notes, any organisation with a supplier, logistics, payment or financing relationship with the company should assume its own contract data may be exposed.
The brand is also already a popular phishing lure. In October, MyBroadband reported SMS campaigns impersonating The Courier Guy that sent recipients to a fake site (thecourify.eu.cc) asking them to "confirm" delivery details. The company described these campaigns as random and sporadic. Separately, the researchers at Sandfish documented a fake Courier Guy page that charged an R18.22 "delivery fee". It was hosted on a public Backblaze B2 bucket and sent victims' card details, followed by their SMS one-time codes, straight to a Telegram chat. Both campaigns came before the November leak and are not linked to MedusaLocker. Still, real internal documents give scammers more convincing material, and Cyfenced warns that leak-site claims are routinely used to make phishing more believable.
On the group itself, Cyfenced reports that MedusaLocker claimed 18 victims in the 30 days before this listing, mostly in the US, Colombia and India and mostly in technology, manufacturing and professional services. A South African logistics company is outside its usual pattern. The f4n6 feed notes that MITRE ATT&CK has no profile for the group, so the name alone tells defenders little about how it operates.
The Attack Technique
The attack method is unknown. Public reporting names no initial access route, vulnerability, CVE, malware sample or tooling, and there is no reported dwell time or exfiltration date. The only technical claim is MedusaLocker's own: it says it got in and took emails, which points to a compromised mailbox or mail system. Nobody has verified that. If MyBroadband's theory is right and the data was taken for sale, then no encryption happened. In that case, a quiet compromise of email or a document store is more likely than a disruptive network-wide attack. Until The Courier Guy or an incident responder publishes findings, every attack chain is speculation.
What Organizations Should Do
- Partners and suppliers: confirm any change to The Courier Guy's banking details, invoices or contract terms by calling a number you already have on file. Do not use contact details from the request itself.
- Landlords, security providers and financiers named in the leak: check which of your own documents (signatories, account numbers, contract values) appear in the dump. Brief your finance teams on supplier impersonation.
- Businesses that use the courier: remind staff and customers that genuine parcel tracking happens on the courier's own website. Treat any SMS asking for a delivery fee or one-time code as fraud.
- Logistics and transport firms generally: review mailbox access controls, enforce phishing-resistant MFA on email and document platforms, and watch for large mailbox exports or bulk downloads. Theft for resale may leave no ransomware trace at all.
- Organisations named on any leak site: never conclude "no breach" from the absence of encryption or obvious intrusion alone. Review email and file-share audit logs for the period before the claim, and decide early what you will report to the regulator.
- Everyone: do not download leaked archives. Cyfenced warns that they can carry malware and that handling stolen personal data may be illegal.
Sources: Private files of South Africa’s top courier company leaked on the d... | How to detect fileless attacks exploiting ToolShell: analyzing the... | Medusalocker leaks operational data from South African courier The... | Courier scam warning in South Africa – MyBroadband | The R18.22 delivery fee that sends card details to Telegram Sandfish | Data, on the House The Breach Brief | The Courier Guy: ransomware claim by medusalocker Cyfenced | The Courier Guy Data Breach: Medusalocker Ransomware Claim (Nov 2026)