Bestbrands.com listed on Cactus ransomware leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: February 18, 2025

The Cactus ransomware group has listed data allegedly belonging to bestbrands.com on their leak site. This announcement, which marks a significant development in the ongoing threat landscape facing the retail sector, involves claims of a major data breach targeting the organization's internal systems and personal information.

The claimed attack and event details

According to the announcement published on February 18, 2025, the threat actor known as Cactus claims to have successfully compromised the institution's operational and personal data. The group has listed the data on its dedicated leak platform, asserting that they have gained access to sensitive internal files. While the announcement was made in mid-February, the group cites the actual attack date as February 3, 2025.

Ransomware leak sites serve as a platform for threat actors to exert pressure on their victims. These sites are used to host stolen data or announcements of impending leaks to coerce organizations into paying ransoms. In many cases, these groups employ a tactic known as double extortion. In a double extortion scheme, attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information and threaten to release it publicly if the ransom is not met. This adds a layer of reputational and regulatory risk to the initial operational disruption caused by the encryption of systems.

The scope of the allegedly leaked data

The data allegedly stolen by the Cactus group is extensive and covers various aspects of the organization's business and personnel files. Based on the information provided by the threat actor, the breach involves a wide range of sensitive information types. The screenshots provided in the leak, which serve as evidence for the group's claims, include examples of identification cards and various business documents.

The allegedly leaked data includes the following items:

• Personally identifiable information (PII)
• Financial data
• Payroll information
• HR documents
• Corporate agreements
• Database backups
• Shipping data
• Corporate OneDrive exports
• Employee personal folders

The presence of such a diverse array of data types suggests a deep level of access into the organization's digital environment, ranging from administrative business records to individual employee files.

About bestbrands.com

Best Brands is a company with over 60 years of experience, specializing in developing licensed products and private label goods for major brands in the kitchenware and home goods industry. With operations in New York, Hong Kong, and China, the firm collaborates with major brands such as Disney, Marvel, and Cuisinart.

Analysis and potential implications

The Cactus group is known for exploiting VPN vulnerabilities to gain initial access to networks. Once inside, they often employ double extortion tactics to maximize their leverage over the victim. This specific incident may pose secondary risks such as identity theft and targeted phishing attacks for the institution's employees and customers, given the sensitive nature of the PII and financial data involved.

Because the organization has operations in the United States, the breach may trigger specific legal obligations. Data breach notification requirements under relevant state laws and federal regulations may arise depending on the nature of the compromised data and the residency of the affected individuals. Furthermore, the nature of the leaked data could have negative impacts on the institution's commercial reputation and operational continuity. The group's past activities suggest that pressure for ransom may increase following the publication of the data.

For organizations operating in the retail and e-commerce sectors, this incident highlights the importance of robust defensive measures. Common defensive steps to mitigate such risks include securing remote access points like VPNs through multi-factor authentication, implementing strict access controls to limit the movement of attackers within a network, and maintaining offline, immutable backups to ensure data integrity. Additionally, continuous monitoring for unusual data exfiltration patterns can help identify a breach before large volumes of data are moved to external sites.