Ransomware victim disclosure
← All victimsDulay and Dulay
listed as dulay.ca · Claimed by Medusa · listed 6 months ago
Status timeline
- Listed
Nov 18, 2025
- Data leaked
At a glance
- Group
- Medusa
- Status
- Data leaked
- Country
- Canada
- Sector
- Technology
- Listed on leak site
- Nov 18, 2025
- Data size
- 500 GB
- Ransom demanded
- $40000
About the victim
AI dossier — public-source company profileDulay and Dulay is a professional accounting firm based in Mississauga, Ontario, serving clients across the Greater Toronto Area and Canada. The firm provides accounting and assurance, tax advisory, consulting, and financial services to a broad range of industries including healthcare, law, construction, real estate, and more. They operate a client portal for secure document and financial information access.
- Industry
- Accounting & Tax Advisory Services
- Address
- Unit 5, 1332 Khalsa Drive, Mississauga, Ontario, Canada
Attack summary
Severity: critical — An accounting and tax advisory firm holds highly sensitive regulated financial and personal data (PII, tax records, financial statements) for a large number of business and individual clients across Canada. 500 GB of exfiltrated data from such a firm constitutes a critical-scale breach of regulated and sensitive financial/personal information.Medusa claims to have exfiltrated approximately 500 GB of data from Dulay and Dulay, with the data listed for sale at $40,000. The post indicates data has been published or is available for purchase.
Data the group says was taken
AI dossier — extracted from the leak post- Client financial records
- Tax documents
- Accounting and assurance files
- Business consulting records
- Client portal data
- Potentially personally identifiable information (PII)
What the group claims
Price-$40000 (sale in one hand there are options for making a profit from these files will be included in the deal) 500Gb
Sources
- Victim sitedulay.ca
Source
Indexed 6 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
