Cactus ransomware group claims data breach against revitalash.com

• Ransomware group: Cactus
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: February 18, 2025

Cactus ransomware group claims data breach against revitalash.com

The Cactus ransomware group has announced a data leak claim against Athena Cosmetics, Inc. (revitalash.com) on their leak site. According to the announcement, the threat actors have targeted the organization, potentially initiating a double extortion process to demand a ransom from the company.

Details of the alleged attack

The Cactus group listed revitalash.com on their leak site on February 18, 2025. The threat actor claims to have gained access to the organization's systems on January 15, 2025. While the group has posted the listing, no information was given regarding the specific ransom demand or the total size of the data stolen.

The group is utilizing a double extortion method. In such cyberattacks, threat actors do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information. The attackers then threaten to release this stolen data on public leak sites if the victim refuses to pay a ransom. This tactic is designed to maximize pressure on the organization by leveraging the threat of public exposure, which can lead to significant reputational damage and secondary risks to supply chain security.

Claimed data types and contents

The announcement claims to contain a vast array of sensitive information. The group alleges that the breach includes personal identifiable information (PII) of over 150,000 customers and employees. Furthermore, the group claims to have accessed various internal corporate documents and technical backups. The provided screenshots reportedly include passport copies, financial reports, and various corporate forms.

The specific types of data claimed to be involved include:

• Customer personal data
• Employee personal data
• Financial data
• HR data
• Corporate correspondence

The inclusion of such diverse data types—ranging from financial statements and HR department data to agreements, complaints, and QA documents—suggests a deep intrusion into the corporate environment.

About revitalash.com

RevitaLash, operating under Athena Cosmetics, Inc., is a cosmetics company that develops and sells eyelash, eyebrow, and hair care products. The company focuses on manufacturing high-quality and reliable personal care products.

Risk assessment and industry implications

The alleged leak may increase the risk of identity theft and fraud due to the exposure of sensitive personal information of employees and customers. As a US-based entity, the organization may face scrutiny under state-level data privacy laws and potential regulatory consequences. The exposure of such a high volume of PII often triggers mandatory notification requirements to regulators and affected individuals.

Given that the Cactus group is known for exploiting VPN vulnerabilities, it is possible that similar security gaps exist within the organization's infrastructure. Vulnerabilities in remote access solutions are a common entry point for ransomware actors, allowing them to bypass perimeter defenses and move laterally through a network.

For organizations operating in the retail and e-commerce sectors, these types of incidents underscore the critical importance of robust cybersecurity frameworks. To mitigate such risks, companies often implement multi-factor authentication (MFA) on all remote access points, such as VPNs, to prevent unauthorized access via stolen credentials. Additionally, maintaining strict network segmentation can help contain a breach and prevent attackers from accessing sensitive HR or financial databases. Regular security audits and vulnerability management programs are also essential to identify and patch the types of weaknesses that groups like Cactus frequently exploit.