Cactus ransomware group claims data breach at plymouth.com

• Ransomware group: Cactus
• Country: United States
• Sector: Manufacturing
• Announcement date: March 11, 2024

Cactus ransomware group claims data breach at plymouth.com

The Cactus ransomware group has listed data on its leak site, claiming it belongs to the manufacturing company plymouth.com. This announcement, made on March 11, 2024, indicates a significant potential exposure of sensitive corporate and personal information belonging to the organization.

Details of the alleged attack

According to the claims made by the Cactus group, the threat actors gained unauthorized access to the organization's networks on January 26, 2024. Following the initial intrusion, the group has moved to a stage of extortion. The group states that it is demanding a ransom of 1.5 million USD in exchange for not publishing the stolen data on their public leak site.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These groups often employ a tactic known as double extortion. In a double extortion scheme, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data before the encryption occurs. This allows them to threaten the victim with the public release of confidential information if the ransom is not met, thereby increasing the pressure on the target organization.

Claimed data and affected information

The leak announcement claims to involve a massive volume of data, totaling over 633 GB. The group asserts that the stolen information includes a wide variety of sensitive files across multiple departments. The specific categories of data allegedly compromised include:

• Accounting records (250GB+)
• HR and payroll documents (150GB+)
• Customer projects and contracts (90GB+)
• Engineering and R&D data (120GB+)
• Legal documents (3GB+)
• Corporate correspondence (20GB+)
• Employees' personal folders and personal identifying information

The presence of such a diverse range of data suggests a comprehensive breach of the corporate environment, spanning from administrative and legal departments to technical engineering sectors.

Organization profile

Plymouth Foundry is an American company operating in the foundry and metalworking sector, specializing in the production of industrial parts.

Analysis and potential risks

The Cactus group is known for gaining access via VPN vulnerabilities and employing double extortion tactics. The exposure of this data carries multifaceted risks for the organization. The presence of personal identifying information in the alleged leak may pose a risk of identity theft for employees and executives. Furthermore, the exposure of corporate data and engineering documents could negatively impact the company's competitive advantage and create risks regarding trade secrets.

Because the organization is based in the US, state-level data privacy regulations and potential legal consequences may be applicable. Given the group's past activities, it is possible that the leaked data could be utilized for targeted phishing attacks against the company or its partners. Organizations in the manufacturing sector often face these types of threats, where the theft of intellectual property and engineering drawings can be just as damaging as the operational disruption caused by the encryption of systems.

Defensive considerations for the sector

To mitigate such risks, organizations typically focus on securing remote access points, as VPN vulnerabilities are a known entry vector for groups like Cactus. Implementing multi-factor authentication, maintaining strict network segmentation to prevent lateral movement, and ensuring robust encryption for data at rest and in transit are standard defensive steps. Additionally, regular monitoring for unauthorized access and comprehensive employee training to recognize phishing attempts remain critical components of a modern cybersecurity posture.