Cactus ransomware group lists contenderboats.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Manufacturing
• Announcement date: March 27, 2024

The Cactus ransomware group has claimed responsibility for a data breach involving the United States-based manufacturing company contenderboats.com. According to an announcement made on the group's leak site on March 27, 2024, the threat actors allege they have successfully exfiltrated a significant amount of sensitive information belonging to the organization.

The alleged intrusion and data theft

The Cactus group claims that the data breach was the result of an intrusion that reportedly occurred on March 4, 2024. Following this alleged breach, the group listed the stolen information on their dedicated leak site. The threat actors claim to have gained unauthorized access to the company's internal financial and operational records, asserting that the stolen data consists of approximately 65GB of information.

Ransomware groups often utilize a tactic known as double extortion. In this scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release confidential information on public leak sites, the attackers aim to pressure the organization into paying a ransom to prevent the exposure of its proprietary and personal data. This method increases the pressure on companies, as the damage from a data leak can persist long after a system has been restored from backups.

Details of the claimed leaked data

The announcement by the Cactus group specifies that the leaked content includes a wide variety of sensitive files. According to the group's claims, the stolen data encompasses the following categories:

• Financial documents
• Personal identification information
• Engineering documents and drawings
• Corporate correspondence
• User personal folders

The group has provided screenshots to support their claims, which allegedly display highly sensitive content. These screenshots reportedly include IRS tax returns, copies of passports, bank signature cards, and loan closing statements. The presence of such documents suggests a significant exposure of private information belonging to individuals associated with the company.

About Contender Boats

Contender Boats is an American marine company that designs and manufactures high-performance, custom-built fishing boats. Based in Florida, the company is well-known for its fiberglass boats specifically designed for offshore fishing.

Implications and potential risks

The alleged leak of such sensitive information carries several significant risks for the organization and its stakeholders. The nature of the shared documents suggests a potential exposure of the company's trade secrets and intellectual property, specifically regarding engineering drawings and technical documentation. Furthermore, the inclusion of personal identification information, tax returns, and passport copies significantly increases the risk of identity theft for the company's employees and executives.

Because the company is a US-based entity, it may face specific legal obligations. Depending on the nature of the data and the residency of the affected individuals, the company may face data breach notification obligations under relevant state laws and federal regulations. Additionally, given the Cactus group's known tactics, there is a possibility that the leaked data could be utilized in secondary attacks, such as targeted phishing campaigns aimed at the company or its clients.

The reported use of VPN vulnerabilities to gain access suggests that there may be weaknesses in the company's cybersecurity infrastructure. To defend against such threats, organizations in the manufacturing sector often implement various defensive measures. These include hardening remote access points, such as VPNs, through multi-factor authentication and regular patching of vulnerabilities. Additionally, robust data loss prevention (DLP) strategies and strict access controls can help limit the amount of sensitive information available for exfiltration in the event of an initial intrusion.