Cactus ransomware group lists curtisint.com on its leak site

• Ransomware group: Cactus
• Country: Canada
• Sector: Technology
• Announcement date: February 12, 2025

Cactus ransomware group claims data breach at Curtis International

The Cactus ransomware group has listed data on its leak site, claiming it belongs to Curtis International. According to the announcement made on February 12, 2025, the threat actor claims to have successfully exfiltrated a significant volume of information from the organization's systems.

Details of the claimed attack

The threat actor known as Cactus published a data leak announcement targeting Curtis International on February 12, 2025. The group claims to have obtained 676 GB of data from the company's systems and has listed it on their leak site. While the announcement was made in February, the group claims the actual attack took place on January 21, 2025. The announcement includes samples of documents, such as financial statements, contracts, and personal identification documents belonging to employees.

The group's announcement type is categorized as a data leak. No information was provided regarding the specific ransom demand or the exact file count involved in the incident.

Claimed data types and contents

The leaked data, as claimed by the Cactus group, encompasses a wide variety of sensitive corporate and personal information. The contents allegedly include:

• Personally identifiable information
• Financial data
• Customer data
• Employee data
• Contracts
• Corporate confidential documents
• Non-disclosure agreements (NDAs)
• Invoices
• Legal documents
• Payrolls
• Corporate correspondence
• Employee personal folders
• Database backups containing customer information

Organization profile

Curtis International is a technology sector entity based in Canada.

Analysis and implications

It can be observed that the Cactus group employs a double-extortion strategy, aiming to exert pressure on the organization by publishing the exfiltrated data. In a double-extortion scheme, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This tactic is designed to increase the pressure on the victim to pay the ransom, as the threat of a data leak can cause significant reputational and legal damage.

As a Canada-based entity, the breach may lead to legal consequences under local data protection regulations such as PIPEDA. The exposure of personal data belonging to employees and customers may increase the risk of identity theft and targeted phishing attacks for the affected individuals. Furthermore, the publication of corporate financial and legal documents could result in reputational damage and competitive disadvantages for the organization.

Public information regarding this group is limited; however, reports suggesting the exploitation of VPN vulnerabilities for network access may necessitate that organizations review their remote access security. To defend against such threats, organizations often implement multi-factor authentication, maintain regular offline backups, and conduct rigorous patch management for all remote access gateways to mitigate the risk of unauthorized entry.