Cactus ransomware group lists asburyauto.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Professional Services
• Announcement date: January 12, 2024

Cactus ransomware group claims data leak against asburyauto.com

The Cactus ransomware group has officially listed asburyauto.com on its dedicated leak site. According to the group's announcement, they claim to have successfully exfiltrated a significant volume of data from the organization's systems. This claim was made on January 12, 2024, and the group asserts that the breach occurred on the same day.

The group alleges that the stolen information consists of approximately 62 GB of data. To support their claims, the attackers have provided various document samples on their leak site. These samples are stated to be part of the organization's operational records, intended to demonstrate the validity of the breach to the public and the targeted entity.

Details of the allegedly stolen data

The content of the screenshots provided by the Cactus group indicates that the leaked material includes a wide variety of sensitive documents. These documents appear to represent a mix of personal, financial, and administrative records that would typically be handled during vehicle sales and customer onboarding processes.

Specifically, the leaked information is said to include the following types of data:

• Social Security Numbers
• Passport information
• Financial agreements
• Driver's license information
• Military personnel records

The presence of such sensitive documentation suggests that the breach could impact a broad range of individuals, including both employees and customers of the organization. The leaked samples specifically mention U.S. military discharge records (DD Form 214), passport application forms, vehicle financing agreements, and Texas driver's licenses.

About Asbury Automotive Group

Asbury Automotive Group is a major automotive retailer operating in the United States. The company provides a comprehensive suite of services, including the sales of new and used vehicles. In addition to vehicle sales, the organization is involved in vehicle maintenance, repair, and the provision of various parts services.

Implications of the breach and security considerations

The alleged leak of 62 GB of data containing highly sensitive personally identifiable information (PII) presents significant risks. For the individuals whose data is involved, the exposure of Social Security Numbers, passport details, and financial agreements significantly increases the risk of identity theft and various forms of fraud. Furthermore, because the organization is based in the United States, the incident may lead to legal sanctions under federal regulations and state-level data protection laws.

The Cactus group appears to be utilizing a double extortion method. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to publish the stolen information on a leak site to pressure the victim into paying a ransom. This tactic is designed to maximize leverage by causing reputational damage and creating security risks within the organization's supply chain.

Reports suggesting that the group may have gained access through vulnerabilities in a VPN suggest that organizations in the automotive and professional services sectors should prioritize the security of their remote access points. To defend against such threats, organizations typically focus on robust network security processes, such as implementing multi-factor authentication, maintaining rigorous patch management for all external-facing services, and conducting regular security audits to identify potential entry points for ransomware actors.