Cactus ransomware group lists bachoco.com.mx on its leak site

• Ransomware group: Cactus
• Country: Mexico
• Sector: Agriculture and Food Production
• Announcement date: December 28, 2023

Cactus ransomware group claims data breach at Bachoco

The Cactus ransomware group has listed the Mexican food producer bachoco.com.mx on its dedicated leak site. According to the announcement made on December 28, 2023, the threat actor claims to have successfully exfiltrated a significant volume of data from the organization. The group asserts that the breach occurred following an attack that took place on December 5, 2023.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on victims through a tactic known as double extortion. In such scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information to threaten its public release. This dual-threat approach aims to maximize the likelihood of a ransom payment by leveraging the potential for reputational damage and regulatory scrutiny that follows a data leak.

Details of the alleged data theft

The Cactus group claims to have obtained 130 GB of data during the alleged intrusion. To support their claims of a successful breach, the group has provided various documents as proof. These files appear to include internal correspondence and various employee records, which the group uses to validate the legitimacy of their theft.

Based on the images and files presented on the leak site, the stolen information includes several sensitive categories. The data allegedly leaked involves:

• Employee identification data
• Employee confidentiality agreements
• Corporate commercial documents

The visual evidence provided by the attackers includes specific documents such as personal identification cards, employee confidentiality agreements, and USDA phytosanitary certificates. No information was given regarding the specific ransom demand or the total file count involved in the incident.

About Bachoco

Bachoco is a global food company based in Mexico. The organization primarily operates in the production and distribution of chicken, eggs, and other processed food products.

Impact and security implications

The exposure of this data carries several significant risks for the organization and its stakeholders. The presence of personal identification data among the leaked files may pose secondary risks to individual employees. Specifically, such information can be exploited for identity theft or used to facilitate highly targeted phishing attacks against the staff members involved.

Furthermore, the disclosure of corporate commercial documents could have a negative impact on the organization's supply chain partners and may potentially weaken the company's overall operational security. From a regulatory perspective, the organization may face legal proceedings under the data protection regulations established in Mexico.

The Cactus group is known as a threat actor that typically gains access to networks through the exploitation of VPN vulnerabilities. Once access is established, they employ double extortion tactics to increase their leverage. For organizations operating in the food production sector, maintaining robust security postures is critical. This includes securing remote access points, implementing strict patch management for VPNs, and ensuring comprehensive monitoring of network traffic to detect unauthorized data exfiltration. Protecting sensitive commercial and employee data is essential to maintaining supply chain integrity and complying with regional data privacy laws.