Cactus ransomware group claims data breach against cleshar.co.uk

• Ransomware group: Cactus
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: March 11, 2024

Cactus ransomware group claims massive data leak against cleshar.co.uk

The Cactus ransomware group has claimed responsibility for a significant data breach targeting cleshar.co.uk, a professional services company based in the United Kingdom. According to an announcement made on the group's leak site on March 11, 2024, the attackers claim to have exfiltrated approximately 1TB of sensitive information belonging to the organization. This incident follows an alleged intrusion into the company's networks that reportedly occurred on February 19, 2024.

The group is utilizing a double extortion tactic, a common ransomware strategy where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to publish the stolen information on a public leak site, the threat actors aim to pressure the victim into paying a ransom. In this specific case, the Cactus group is demanding a ransom of $1,000,000 USD to prevent the release of the data. Additionally, the group has reportedly set a separate price of $10,000 for the release of the file tree structure.

Details of the alleged data theft

The scope of the data allegedly stolen by the Cactus group is extensive, covering various aspects of the organization's internal operations and client relations. The group claims to have gained access to a wide range of sensitive documents, including financial records, personal files, and corporate communications. Based on the information provided by the attackers, the leaked data is said to include:

• Financial records
• HR payrolls
• Personally Identifiable Information (PII)
• Customer contracts
• Engineering documents
• Corporate correspondence

The content of the alleged leak is highly sensitive, encompassing accounting, tax, and treasury records, as well as HR payroll information. Furthermore, the group claims to have obtained personal files, customer projects, contracts, engineering and R&D documents, legal papers, and corporate correspondence. The breach also reportedly includes employee personal folders. Screenshots provided by the group allegedly display highly sensitive personally identifiable information (PII), such as copies of passports, driver's licenses, and various invoice documents.

About cleshar.co.uk

Cleshar is a UK-based professional services company. The organization specializes in providing staffing, engineering, and technical support services. Their operations primarily focus on supporting the railway and transportation sectors, making them a key player in critical infrastructure support services within the United Kingdom.

Potential risks and security implications

The alleged leak by the Cactus group carries significant risks for both the organization and the individuals whose data has been compromised. For the employees and customers of cleshar.co.uk, the exposure of personally identifiable information, such as passports and driver's licenses, creates a heightened risk of identity theft and targeted phishing attacks. Such attacks often leverage stolen personal details to gain further access to accounts or to conduct fraudulent activities.

From a legal and regulatory standpoint, because the organization is based in the United Kingdom, the leaked data may fall under the jurisdiction of the UK GDPR. This could potentially trigger legal consequences and regulatory scrutiny regarding data protection compliance. Furthermore, the use of double extortion tactics by the Cactus group can lead to severe impacts on an organization's commercial reputation and its ability to maintain operational continuity.

Regarding the methods used by the attackers, information about the Cactus group remains limited. However, it has been reported that the group utilizes vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to target networks. To defend against such threats, organizations in the professional services and transportation sectors are encouraged to implement robust security measures, such as securing VPN access with multi-factor authentication, maintaining rigorous patch management schedules to close known vulnerabilities, and conducting regular monitoring of network traffic to detect unauthorized access or large-scale data exfiltration.