Cactus ransomware group lists cornwelltools.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: February 4, 2025

Cactus ransomware group claims massive data breach at Cornwell Quality Tools

The threat actor known as Cactus has officially listed a significant amount of data on its leak site, claiming the information belongs to the United States-based company Cornwell Quality Tools. According to the announcement published on February 4, 2025, the group asserts that it has successfully compromised the organization's systems, resulting in the theft of a massive volume of data totaling 4.6 TB.

Details of the alleged attack

The Cactus ransomware group published this leak announcement on February 4, 2025. While the announcement was made in February, the group claims that the actual breach occurred much earlier, allegedly taking place on December 18, 2024. By providing a portion of the stolen data as proof of the intrusion, the group asserts that it has gained unauthorized access to the company's sensitive operational and personal information.

Ransomware groups often utilize a tactic known as double extortion. In this scenario, attackers do not merely encrypt a company's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. This allows the threat actors to threaten the victim with the public release of their private information if a ransom demand is not met, creating additional pressure on the organization.

Data types involved in the leak

The announcement states that the stolen data is extensive and includes a wide variety of sensitive documents and records. The group claims the following types of information were compromised:

• Employee personal data
• Customer personal data
• Credit card information
• Financial documents
• Tax records
• Contracts

Beyond these categories, the group claims the data includes corporate contracts, non-disclosure agreements (NDAs), TechCredit loan application forms, payroll records, corporate correspondence, and databases containing over 1 million records of credit card information. To support their claims, the group has provided screenshots that reportedly show W-9 tax forms, driver's licenses, and various loan application documents.

About Cornwell Quality Tools

Cornwell Quality Tools is a US-based company that has been operating since 1919. The organization manufactures and sells a variety of products, including hand tools, power tools, and lawn care equipment. Operating as a family and employee-owned business, the company focuses on providing high-grade alloy steel tools specifically designed for professional users.

Analysis and potential impact

This incident may significantly increase the risk of identity theft and financial fraud for both the employees and the customers of Cornwell Quality Tools. The presence of highly sensitive information, such as Social Security Numbers (SSNs) and dates of birth, within the leaked data could facilitate long-term, targeted phishing attacks against the victims. Such attacks often leverage personal details to gain trust and extract further sensitive information or financial assets.

The Cactus group is known for exploiting vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to networks. Because the group utilizes double extortion tactics, there remains a risk of further exposure if ransom demands are not met. Furthermore, the company may face specific notification obligations under United States laws and relevant data protection regulations due to the nature of the compromised data.

For organizations operating in the retail and manufacturing sectors, maintaining robust cybersecurity defenses is critical. Common defensive steps include implementing multi-factor authentication (MFA) across all remote access points, such as VPNs, to mitigate the risk of credential exploitation. Additionally, regular patching of software and monitoring for unusual data exfiltration patterns can help detect and prevent such large-scale breaches. Given the sensitive nature of the data involved in this claim, such incidents highlight the ongoing necessity for comprehensive data protection strategies to safeguard personal and corporate information.