Cactus ransomware group claims data breach at kjtait.com

• Ransomware group: Cactus
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: September 25, 2024

Cactus ransomware group claims data breach at kjtait.com

The Cactus ransomware group has listed data allegedly belonging to the UK-based engineering firm kjtait.com on their leak site. According to the announcement made on the group's platform, the organization has been targeted in a cyberattack that resulted in a significant data exfiltration.

Details of the alleged attack

The Cactus group created a leak announcement on September 25, 2024, claiming to have compromised data belonging to kjtait.com. The group alleges that the breach occurred around September 12, 2024, and that approximately 1.2 TB of data was exfiltrated from the organization's network. No information was provided regarding the specific ransom demand.

By publishing these files, the group aims to exert pressure through a double-extortion scheme. Double extortion is a common tactic used by modern ransomware groups, where the attackers not only encrypt the victim's systems to disrupt operations but also steal sensitive information. The threat of leaking this data publicly is used as leverage to coerce the victim into paying the ransom, even if the organization has robust backups to restore their systems.

Data and information involved in the leak

The samples shared in the announcement include various types of sensitive documentation. These include copies of passports, driver's licenses, non-disclosure agreements, engineering project documents, database backups, and corporate correspondence. The listing identifies several categories of affected information:

• Personally Identifiable Information (PII)
• Employee personal data
• Customer information
• Financial documents
• Corporate contracts
• Project drawings

The exposure of such a wide range of data, particularly technical drawings and personal identification, presents significant risks to the individuals and the entity involved.

About kjtait.com

KJ Tait Engineers is a professional consultancy firm providing mechanical, electrical, and public health (MEP) engineering services for buildings and associated infrastructure. Operating across the UK, the company maintains offices in Aberdeen, Cambridge, Edinburgh, Glasgow, and London.

Analysis and potential impact

This action by the Cactus group may increase the risk of identity theft and targeted phishing for the organization's employees and customers. Given the nature of the leaked data, it is possible that the organization could face legal and administrative sanctions under the UK GDPR. The exposure of technical drawings related to engineering projects may lead to the disclosure of trade secrets and damage the organization's competitive advantage.

The group's use of a double-extortion method suggests that secondary attack risks may persist following the data publication. The group, which emerged in 2023, is known to gain access to networks via VPN vulnerabilities; this may indicate potential weaknesses in the organization's cybersecurity infrastructure.

For organizations in the professional services and engineering sectors, such incidents highlight the critical importance of securing remote access points. Implementing multi-factor authentication (MFA) on all VPN connections and maintaining strict patch management for all network perimeter devices are essential defensive steps. Furthermore, because technical drawings and project documents are high-value targets, organizations should prioritize the encryption of sensitive intellectual property and implement robust data loss prevention (DLP) measures to detect and block unauthorized exfiltration attempts.