Ransomware group MedusaLocker has published internal documents it says it stole from The Courier Guy, three months after the courier company first appeared on the gang's dark web leak site.
What happened
MedusaLocker relisted The Courier Guy on 4 November 2026, this time with files attached instead of a list of filenames. The gang says the dump covers purchase orders to suppliers, staff recruitment and training records, leave schedules, and shopping centre lease renewals for branches around the country, along with security SLAs and vehicle finance documents.
The asking price fell from R493,400 (about $30,000) at the first listing to $14,548 (about R239,300) at the second, which suggests the earlier offer drew little interest.
The Courier Guy says it investigated with cybersecurity specialists and identified a single legacy file server as the likely source of the data. That server was isolated. The company states no ransomware was deployed, no systems were encrypted, and core operational platforms were unaffected. It reported the August incident to the Information Regulator and the South African Police Service, notified suppliers, and says no customer, parcel or delivery data was involved and no ransom demand has been received.
Who is affected
The exposure sits with the parties named in those documents rather than with parcel recipients.
- Suppliers and landlords whose pricing, SLA terms and lease negotiations appear in the published files.
- Staff whose recruitment, training and leave records were in scope, which is personal information under POPIA.
- Any partner organisation now receiving a follow-up email that quotes those documents accurately.
- South African businesses running the same pattern: an old file server that everyone forgot owns a share of the company's commercial history.
What to do now
Treat unmanaged file servers as your most likely exfiltration point, not your least likely one, and get them inventoried, backed up and logged this week.
- List every SMB share and file server that falls outside your endpoint protection and backup scope. Legacy servers are usually outside both.
- Check firewall and proxy logs for bulk outbound transfers from file servers, including overnight and weekend windows.
- Review what commercial documents actually live on those servers: supplier pricing, lease agreements and finance paperwork are the material that gets published.
- If your data appears in a leak like this, assess the section 22 notification duty on the facts. Unauthorised access triggers it, not encryption.
- Rotate any credentials, service accounts or API keys that were stored on the old server.
What this means for South African businesses
This incident is a useful correction to the assumption that a ransomware attack means encrypted servers and a business interruption claim. Here nothing was encrypted, the operational platforms kept running, and the damage still arrived as published supplier pricing, lease terms and staff records.
The realistic lesson for an SME is that the quiet half of these attacks does not announce itself: a stolen file share is often discovered on a leak site weeks later, long after the access was used, and POPIA obligations start when the access happened, not when the listing appeared.
The primary reporting on this incident is from MyBroadband.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.