ATCO Ltd Data Breach

ATCO Ltd, a diversified Canadian energy and utilities company providing electricity, natural gas, and infrastructure services across North America, was targeted by the MedusaLocker ransomware group. The listing of ATCO Ltd as a victim was identified through SOCRadar’s Dark Web Monitoring on September 28, 2026. As a major regulated utility with critical infrastructure, ATCO presents a potentially high-impact target for ransomware attacks due to the cascading consequences of service disruption. MedusaLocker has claimed 19 other victims in the past 60 days, positioning them as a less prolific operator compared to some other ransomware gangs. Their typical targets have predominantly been in the Manufacturing, Other, and Technology sectors, primarily within Canada and France, among other geographies. The inclusion of ATCO Ltd, a large-scale utility provider, represents a significant deviation from MedusaLocker’s usual targeting of small-to-mid-market entities, suggesting a potential shift towards higher-profile organizations, possibly due to opportunistic initial access broker (IAB) activity or a deliberate escalation in targeting ambition. Notable recent victims claimed by MedusaLocker include Twal Family IT Lab, Abv, Seznam, and Aokkef.

The domain reference found in the available data for ATCO Ltd appears to link to a third-party email service rather than ATCO’s primary corporate domain. This observation significantly limits the inferential value of the stealer-log query for assessing ATCO’s specific credential exposure. A direct query against ATCO’s actual corporate domain would be necessary to conduct a meaningful assessment of its credential exposure. Consequently, the current null result should not be interpreted as an indication that the organization is unaffected by credential compromise. The potential for infostealer-harvested credentials to support ransomware operations remains a concern, particularly if credentials associated with a third-party service were reused or shared across ATCO’s internal network. The presence of such credentials could, in some scenarios, facilitate initial access or lateral movement within a victim’s environment. Given ATCO’s classification as a critical infrastructure provider, the implications of unauthorized access could be severe, potentially leading to widespread disruption of essential services. ATCO is a higher-profile target than MedusaLocker typically lists. Energy utilities carry elevated societal risk in ransomware scenarios — disruption to electricity or natural gas infrastructure has cascading consequences. If this listing is genuine, the access vector and current depth of compromise warrant rapid triage beyond standard dark web monitoring. Next Steps Run a separate stealer-log query against the organization’s actual corporate domain. Escalate monitoring priority given the critical infrastructure profile. Coordinate with relevant sector-specific threat-sharing bodies. Internal incident triage against remote-access systems and VPN logs is recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.