Cactus ransomware group lists biagibros.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Transportation
• Announcement date: March 21, 2025

Cactus ransomware group leaks data belonging to Biagi Bros

The Cactus ransomware group has published 820 GB of data on its leak site that the group claims belongs to the logistics and supply chain management company, biagibros.com. This announcement, made on March 21, 2025, follows a period of alleged unauthorized access to the organization's systems.

According to the claims made by the Cactus group, the incident that led to this data exposure allegedly occurred on January 9, 2025. Following the initial attack, the group stated on February 13, 2025, that the entire dataset had been leaked and subsequently provided download links for the stolen information. The group alleges that the breach compromised critical assets, including the company's database backups, financial documents, and various forms of personally identifiable information.

Details of the allegedly leaked information

The volume and nature of the data claimed to be stolen by the Cactus group suggest a significant breach of sensitive information. The group alleges that the leaked dataset contains a wide variety of corporate and personal records. Based on the information provided by the threat actor, the compromised data includes:

• Employee personally identifiable information (PII)
• Background reports
• Driver's licenses
• Identification cards
• Database backups
• Financial data
• Legal documents
• Customer data
• Contracts
• Corporate correspondence

To support these claims, the group has provided screenshots as evidence, which reportedly show a California driver's license and corporate income statements.

About Biagi Bros

Biagi Bros is a logistics and supply chain management company that operates throughout the United States. The organization manages a network of distribution centers, warehouses, and truck terminals. It specializes in providing third-party logistics (3PL) solutions designed to meet the diverse transportation and warehousing requirements of various businesses.

Risk assessment and implications

The scale and specific types of data allegedly leaked pose a high risk of identity theft and fraud for both the employees and the customers of the organization. Because the company is a United States-based entity, this breach may lead to legal repercussions under California state laws and other relevant data protection regulations.

The Cactus group appears to be employing double-extortion tactics. In such scenarios, threat actors do not merely encrypt a company's data to halt operations; they also steal sensitive information to use as leverage. This stolen data can be utilized in secondary attacks or targeted phishing campaigns against the organization or its stakeholders. Furthermore, because Biagi Bros operates within the logistics sector, its supply chain partners may also be adversely affected, facing potential risks to their own operational reliability.

In general, when organizations face such threats, they often look toward defensive strategies such as implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of phishing. For companies in the transportation and logistics sector, maintaining the integrity of the supply chain is critical, as a breach in one node can create ripple effects across multiple business partners.