ActionAid-adjacent naming surfaced in early May 2026 MedusaLocker leak-site summaries alongside TACOSA branding, prompting NGO-sector watchers to harden phishing and finance controls irrespective of finalized victim statements.
Canonical record: ActionAid / TACOSA 2026 listing on BreachHistory.
Source: HookPhish