Ransomware victim disclosure
← All victimsbapamai
Claimed by MEDUSA LOCKER (aka BAVACAI · listed 5 days ago
Status timeline
- Listed
May 27, 2026
Current state: Listed for ransom
At a glance
About the victim
AI dossier — public-source company profilebapamai is a German legal firm or practice, likely based in the Hesse region given references to multiple local court cases (Darmstadt, Langen, Ober-Roden, Bensheim). The victim name appears to be a placeholder or internal identifier rather than the formal company name.
- Industry
- Legal Services
Attack summary
Severity: critical — Confirmed exfiltration of legal work product and client case files, which constitute highly sensitive attorney-client privileged information and regulated data. Scale of 8,050 files indicates substantial client portfolio exposure. German legal practice subject to strict confidentiality obligations.MEDUSA LOCKER claims to have exfiltrated approximately 8,050 files from bapamai's systems. The leaked files consist primarily of court case documents (GBA filings), indicating access to confidential client legal records and case materials.
Data the group says was taken
AI dossier — extracted from the leak post- Court case documents (GBA filings)
- Legal client files
- Court correspondence
- Case numbers and court references
- Client names (inferred from document titles)
The group's post references roughly 10 proof files.
What the group claims
German legal/notarial records including Grundbuchamts (land registry) documents, court filings, and related legal correspondence from various German localities including Gundernhausen-Darmstadt, Ober-Roden, Schwanheim, and Bensheim.
The leak post
captured from the group's site⚠ Demo access — showing up to 10 files per folder. Full data will be available after publication. | | | | [(006-2023 N) GBA v. Gundernhausen-Darmstadt Blatt 2149 Wohlgemuth.doc](http://t33zoj4qwv455fog7qnb2azi5xcdxkixughmmduzbw2rtdgryqfbh6id.onion/company/bapamai/preview/\(006-2023%20N\)%20GBA%20v.%20Gundernhausen-Darmstadt%20Blatt%202149%20Wohlgemuth.doc) | | [(007-2023 N) Friedrich, Ubegl.mit Weiterleitung.doc](http://t33zoj4qwv455fog7qnb2azi5xcdxkixughmmduzbw2rtdgryqfbh6id.onion/company/bapamai/preview/\(007-2023%20N\)%20Friedrich,%20Ubegl.mit%20Weiterleitung.doc) | | [(007-2024 N) GBA v. Ober-Roden, AG Langen Hessen, Blätter 6142 u. 6214 Förster-R-.doc](http://t33zoj4qwv455fog7qnb2azi5xcdxkixughmmduzbw2rtdgryqfbh6id.onion/company/bapamai/preview/\(007-2024%20N\)%20GBA%20v.%20Ober-Roden,%20AG%20Langen%20Hessen,%20Bl%C3%A4tter%206142%20u.%206214%20F%C3%B6rster-R-.doc) | | | | [(009-2022 N) GBA Kusche (Rappe) -.doc](http://t33zoj4qwv455fog7qnb2azi5xcdxkixughmmduzbw2rtdgryqfbh6id.onion/company/bapamai/preview/\(009-2022%20N\)%20GBA%20Kusche%20\(Rappe\)%20-.doc) | | | [(011-2023 N) GBA v. Schwanheim Blatt 6258 (Werkmann).doc](http://t33zoj4qwv455fo…
Data the group says was taken
- legal documents
- court filings
- land registry records
Screenshot of the leak post
Sources
Source
Indexed 5 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
Is this your supplier? Your competitor? You?
Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.