Medusa just hit 500 critical infrastructureorgs. Every breach exploited a known CVE nobody patched.

CISA, FBI, and HHS updated their joint advisory on August 18.

Medusa ransomware has breached over 500 critical infrastructure organizations.

Healthcare. Defense. Manufacturing. Government. Financial services.

Every single one exploited a known vulnerability.

Not zero-days. Not sophisticated nation-state tools.

Known CVEs in VPN appliances, email gateways, and remote access platforms that organizations knew about and did not fix.

Medusa operators move faster than your patch cycle.

The advisory says they recruit initial access brokers on cybercriminal forums and pay between $100 and $1 million for credentials to your network.

Once inside, they encrypt your data and threaten to leak it publicly.

Double-extortion. The same playbook that took down Minneapolis Public Schools in 2023 is now hitting hospitals and defense contractors at scale.

Here is what nobody is saying:

If your AI workloads run on the same unpatched infrastructure as your crown jewels, your AI security posture is theater.

The65% of organizations that experienced AI agent security incidents this year share the same root cause as these 500 Medusa victims.

Nobody owns the patch.

Audit your VPN, email gateway, and remote access patch cadence against CISA's Known Exploited Vulnerabilities catalog today.

If you are behind, you are already a target.

SOURCE: https://www.bleepingcomputer.com/news/security/cisa-medusa-ransomware-hit-over-500-critical-infrastructure-orgs/
VERIFIED: CISA Advisory AA25-071A (updated August 18, 2026), BleepingComputer (August 19, 2026), SecureBlink (August 19, 2026)
SIGNAL: 500 critical infrastructure breaches from known CVEs exposes the gap between security awareness and security action. If your enterprise AI runs on the same unpatched infrastructure, your AI investment is one misconfigured VPN away from a ransomware event.