By Joshua Tosin Ogunsakin 
The FBI has alerted the over 1.8 billion Gmail users about a serious ransomware threat that could compromise their private data.
Investigations have revealed that the Medusa ransomware group has targeted more than 300 victims using phishing tactics to exploit vulnerabilities in users’ software.
According to the FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA), this scheme has had a particularly harsh impact on critical infrastructure sectors, affecting employees in hospitals, schools, and major corporations.
Medusa infiltrates computers by deceiving users with fraudulent emails or exploiting weak points in their systems through malicious online content, such as fake websites. Once it gains access, it encrypts important files, rendering them inaccessible, and also exfiltrates copies of the data.
After holding the victim’s data hostage, Medusa demands a ransom that can reach into the thousands or even millions of dollars to restore access and avoid leaking sensitive information publicly.
To protect against these ransomware attacks, the FBI and CISA recommend that anyone using email services like Gmail enable two-factor authentication (2FA). This adds an extra layer of security by requiring a texted code before logging in.
Additionally, users and businesses are advised to check their operating systems, software, and firmware to ensure they are up-to-date with the latest security patches.
For those storing sensitive information, it’s crucial to maintain multiple backups on separate servers or drives. For personal documents or photos in Gmail, consider printing physical copies and storing them in a secure location.
For larger organizations, CISA advises implementing network traffic filters to restrict access to remote services from unknown or untrusted sources. Companies with numerous employees should configure their networks to allow only trusted individuals or systems to access critical internal tools, effectively preventing intrusions from hackers like Medusa.
Organizations should also review administrative privileges, limiting them to essential functions to reduce the potential for severe damage from compromised accounts. To protect institutions like hospitals and schools, authorities suggest segmenting computer networks into smaller sections. This approach, known as “network segmentation,” creates barriers between different departments, making it more difficult for Medusa to spread and hold more files hostage.
These ransomware attacks are not random incidents; the FBI highlighted that Medusa operates as a ransomware-as-a-service group. They develop malicious software that locks down victims’ computers and sell it to cybercriminals who execute the attacks. Ransom payments are then split between the hackers and the Medusa group.
Reports indicate that ransom demands from Medusa range from $100,000 to $15 million, with over 40 reported victims between January and February 2025 alone. However, cybersecurity experts believe the actual number may be higher, as some victims may have paid ransoms without reporting the incidents.
In one case, Wisconsin’s Bell Ambulance experienced a Medusa attack resulting in the theft of over 200 gigabytes of data, with a ransom demand of $400,000 for its return. In the UK, HCRG Care Group faced a $2 million demand after hackers stole 2.3 terabytes of data.
For the nearly two billion Gmail users concerned about their accounts, cybersecurity experts emphasize the importance of maintaining an active spam filter to block phishing emails. Users should delete any suspicious emails that prompt them to click links or provide personal information immediately, as these links could lead to malicious sites that allow hackers to take control of their devices.