Cactus ransomware group claims data leak involving matki.co.uk

• Ransomware group: Cactus
• Country: United Kingdom
• Sector: Manufacturing
• Announcement date: October 8, 2024

Cactus ransomware group claims data leak involving matki.co.uk

The Cactus ransomware group has officially listed the United Kingdom-based organization matki.co.uk on its leak site. According to the group's announcement, they claim to have successfully executed a data breach against the company, resulting in the acquisition of a significant volume of sensitive information.

The group alleges that the incident occurred on September 19, 2024. Through their announcement, they claim to have obtained various datasets belonging to the organization, which they have subsequently posted on their platform. The total size of the data set claimed by the group is 267 GB, which reportedly contains a mix of operational and personal information.

Details of the alleged breach

The announcement made by the Cactus group suggests that the stolen information is quite diverse, covering multiple aspects of the organization's internal operations and personal records. The group claims that the leaked data includes several critical categories of information that could impact both the company and its individuals.

According to the claims made on the leak site, the following types of data have been compromised:

• Personally identifiable information
• Database backups
• Financial documents
• Employee data
• Corporate correspondence

To support their claims, the group has provided screenshots intended to prove the validity of the breach. These visual samples reportedly include sensitive documents such as passport samples, driving licenses, and various corporate insurance application forms. No information was provided regarding a specific ransom demand or the exact file count within the leaked dataset.

Implications and risks

The exposure of such a wide range of data carries significant risks for the affected organization and its stakeholders. The presence of personally identifiable information, such as passports and driving licenses, significantly increases the risk of identity theft for the organization's executives and employees. Furthermore, the exposure of corporate and financial documents could have a negative impact on the organization's business operations and may lead to regulatory consequences under the UK GDPR.

The Cactus group is known for employing double-extortion tactics. In these scenarios, attackers do not just encrypt an organization's systems but also steal sensitive data, threatening to leak it publicly unless a ransom is paid. This tactic increases the pressure on victims, as the threat of data exposure can cause irreparable reputational and legal damage even if the company can restore its systems from backups.

Given the group's history of exploiting vulnerabilities in VPNs to gain network access, this incident highlights the necessity for organizations to maintain a rigorous security posture. For companies in the manufacturing sector, protecting intellectual property and sensitive operational data is vital. General defensive measures often include implementing multi-factor authentication, conducting regular vulnerability assessments, and ensuring that all remote access points, such as VPNs, are patched and secured against known exploits. A thorough review of security infrastructure is a critical step for any organization facing such threats to prevent secondary attacks or targeted phishing campaigns that often follow a data leak.