Cactus ransomware group lists data belonging to natcoglobal.com

• Ransomware group: Cactus
• Country: United States
• Sector: Manufacturing
• Announcement date: September 17, 2024

The Cactus ransomware group has listed a significant amount of data allegedly belonging to natcoglobal.com on its dedicated leak site. According to the announcement made by the threat actors, the stolen information totals approximately 111 GB. This development follows a period of unauthorized access that the group claims occurred earlier in the year.

The details of the alleged attack

The threat actor known as Cactus announced the listing of data belonging to natcoglobal.com on September 17, 2024. While the announcement was made in mid-September, the group claims that the actual data was obtained on August 1, 2024. The leak site announcement includes download links intended to provide access to the allegedly exfiltrated operational and personal data.

Ransomware groups often utilize leak sites to host stolen information as part of a pressure tactic. This method is frequently associated with double-extortion strategies, where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. By making the data available for download, the group aims to exert maximum pressure on the target organization to fulfill ransom demands.

The scope of the claimed data breach

The announcement claims that the stolen information includes a wide variety of sensitive materials. The data is said to contain employee personal and corporate data, customer information, corporate correspondence, and database backups. To support these claims, the group provided screenshots that appear to show financial statements, vendor forms, and accounting records.

The specific types of data mentioned in the listing include:

• Employee personal data
• Corporate data
• Customer information
• Financial records
• Corporate correspondence

The potential exfiltration of corporate database backups is particularly significant, as such data can have long-term impacts on an organization's operational continuity. When backups are compromised, it complicates the recovery process and provides attackers with a blueprint of the organization's internal structures.

About North American Textile Company (NATco)

North American Textile Company (NATco) is a global manufacturing company that produces labels, trims, and hardware products. Founded in 1991, the company is headquartered in California and operates manufacturing facilities in several countries, including Italy, China, and India.

Risk assessment and organizational implications

This action by the Cactus group may pose secondary risks such as identity theft and targeted phishing attacks for the organization's employees and customers. Because the stolen data includes personal information, individuals associated with the company may be targeted by malicious actors using the leaked details to craft convincing social engineering campaigns.

Given that the organization has US-based operations, the leaked data could trigger legal processes under state-level data privacy laws and regulations. Organizations operating in highly regulated sectors or across multiple jurisdictions must often navigate complex notification requirements following a confirmed breach.

For organizations in the manufacturing sector, such incidents highlight the importance of robust data protection and incident response plans. Defensive steps typically include implementing strict access controls, maintaining offline and immutable backups, and conducting regular security awareness training to mitigate phishing risks. Furthermore, monitoring for unauthorized data exfiltration and maintaining comprehensive logs are essential for detecting such activities before large volumes of data can be moved out of the network.

• No information was provided regarding the specific ransom demand.