Ransomware group releases 625.5GB of compressed file claimed to be from PhilHealth

Potential data equivalent to over 219 thousand pages or 256 HD Movies


At a glance

  • The Medusa ransomware group has made public 625.5GB of compressed data, which they allege originates from PhilHealth. When unzipped, experts suggest this could exceed 1TB.

  • Given the sheer size of the data, it's likely to contain a significant volume of sensitive information, potentially encompassing personal details, financial records, and medical documentation.

  • While PhilHealth still needs to verify the authenticity of the data as being sourced from their systems, they have promptly advised their members to remain vigilant and implement measures to safeguard their personal data.


Reports from cybersecurity chat groups and information from government agencies indicate that on October 5, the Medusa ransomware group began releasing compressed files alleged to be from PhilHealth. These files in zip format are in 160 parts with 3,891MB each or 622 GB. There is also one file of 3.5GB. The total file size available for download from Medusa is 625.5GB in zip format. Renzon Cruz, Principal DFIR Consultant at Unit 42 by Palo Alto Networks and John Patrick Lita, CEO and co-founder of SOROS Securities Inc., said this zip file could be more than 1TB if unzipped.

How big is 1TB? Here's a rough estimate that will put the size in perspective.

If we convert 1TB of data into a text file, assuming that the text is single-spaced and uses a font size of 10 points, a legal-sized bond paper (8.5 x 14 inches) can hold approximately 1000 words of text. It is estimated that 1000 words are about 5000 bytes. This means that 1TB of text, equal to 1,099,511,627,776 bytes, would be approximately 219,902,325 words and fit into 219,903 legal-sized bond paper.

If we convert 1TB of data into HD Movies, assuming that each 1080p movie is 4GB, 1TB of data can be used to create 256 movies.

Remember that these are just estimates, and the number of words that can fit into a 1TB file will vary depending on the specific factors. The statement that 1000 words is about 5000 bytes is a general rule of thumb but is not always accurate. The actual number of bytes in 1000 words depends on the encoding used. Again, these are just estimates. 

The size of the data that the Medusa ransomware group is releasing suggests that it could contain a significant amount of sensitive information, which may include personal data, financial data, and medical records.

PhilHealth has yet to confirm that the data being released by the Medusa ransomware group is from their systems. However, the company has advised its members to be vigilant and to take steps to protect their personal information.