A ransomware operation that has compromised more than 500 critical infrastructure organizations is highlighting a major challenge for security leaders: attacks are becoming increasingly industrialized, while many organizations remain focused primarily on preventing them.
CISA, the FBI and the Department of Health and Human Services recently issued a joint advisory on Medusa, a ransomware operation that emerged as a closed variant in January 2021 before evolving into a ransomware-as-a-service model.
Since June 2021, Medusa has compromised more than 500 organizations across critical infrastructure sectors including healthcare, the defense industrial base, critical manufacturing, government services, IT, financial services, education, legal and insurance. The number represents a sharp increase from the more than 300 victims reported in March 2025.
For Arvind Parthasarathi, CEO and founder of cyber resilience company CYGNVS, the scale of the campaign reflects an important evolution in the ransomware threat.
“More than 500 critical infrastructure victims is a reminder that ransomware is no longer an exceptional event organizations can plan to prevent and assume they will avoid,” Parthasarathi said. “Groups like Medusa have industrialized the attack model, buying access, exploiting vulnerabilities and moving quickly from intrusion to extortion.”
That industrialization could accelerate further as attackers adopt artificial intelligence.
“AI will accelerate that shift, taking cyberattacks from an artisan world of ones and twos to an industrial world where hundreds of organizations can be targeted at scale,” Parthasarathi said.
From prevention to resilience
The implications extend beyond how organizations defend their networks.
Traditional cybersecurity measures such as patching vulnerabilities, segmenting networks and strengthening access controls remain critical. But as attackers increase the speed and scale of their operations, Parthasarathi argues that organizations also need to prepare for the possibility that those defenses will fail.
“Organizations cannot focus on prevention alone. They have to transition to resilience, starting with the assumption that an attacker may still get through,” he said.
Once that happens, the nature of the incident changes. A ransomware attack can rapidly require decisions well beyond the security organization, involving executives, IT, legal, communications, insurers and outside counsel.
Those decisions may also have to be made while email, messaging platforms and other normal business systems are unavailable or cannot be trusted.
“At that point, this becomes a business crisis, not just a security incident,” Parthasarathi said. “Executives, security, IT, legal, communications, insurers and outside counsel may all need to make consequential decisions while the organization’s normal systems are potentially compromised.”
Preparing for the moment defenses fail
That makes preparation increasingly important for controlling the aftermath.
Organizations can establish decision-making authority in advance, test cross-functional incident response playbooks and maintain secure, out-of-band communications that allow teams to coordinate when their primary networks are compromised.
Practicing those scenarios can also help organizations address a less immediate but increasingly important challenge: explaining their actions after the crisis has passed.
“The questions leaders need to ask are simple,” Parthasarathi said. “When it happens, are we ready? Will our response be controlled and organized? And can we justify the decisions we made to regulators and courts afterward?”
Medusa’s expanding victim count suggests those questions are becoming harder for organizations to treat as hypothetical. As ransomware becomes more scalable and AI potentially accelerates that trend, the measure of cybersecurity maturity will be how effectively the business operates when an attacker gets in.
Join our LinkedIn group Information Security Community!
