Cactus ransomware group lists everelgroup.com on its leak site

• Ransomware group: Cactus
• Country: Italy
• Sector: Manufacturing
• Announcement date: February 24, 2025

Cactus ransomware group targets Everel Group

The Cactus ransomware group has officially listed the Italian company Everel Group on its dedicated leak site. According to the announcement made on February 24, 2025, the threat actor group claims to have successfully breached the organization's systems. This listing follows a claimed initial access date of February 12, 2025, although the group has not provided specific details regarding the exact method of entry into the corporate network.

The announcement indicates that the attackers have acquired various corporate documents through their unauthorized access. The group claims that the leaked information includes documentation related to the organization's operational and financial processes, suggesting a deep penetration into the company's internal data environments.

Claimed data and information types

Based on the records and screenshots provided by the threat actors, the breach may involve a wide array of sensitive information. The leaked data is reported to include highly confidential corporate and personal files that could impact various departments within the organization. The specific categories of data mentioned in the claim include:

• Personally identifiable information
• Employee personal documents
• Financial documents
• Payroll
• Contracts
• Engineering drawings

The presence of such diverse data types suggests that the attackers may have targeted multiple repositories, including databases and file servers, to extract a broad spectrum of information ranging from administrative records to technical intellectual property.

About Everel Group

Everel is an Italian company specializing in the production and supply of electromechanical components for the household appliance and automotive sectors. The company serves as a key supplier in the industrial supply chain, providing essential parts to leading home appliance manufacturers and major automobile producers. Given its role in these sectors, the company's data holds significant value for both its operational continuity and its relationships with global manufacturing partners.

Potential impact and security implications

This incident may pose a significant risk to the organization's operational continuity and overall data privacy. The inclusion of employees' personal documents among the leaked data creates a potential foundation for identity theft and targeted phishing attacks against the workforce. Furthermore, because the organization is based in Italy, the breach may trigger specific legal obligations, such as data breach notifications and administrative sanctions under the General Data Protection Regulation (GDPR).

The Cactus group is known for employing a double extortion method, where attackers not only encrypt systems but also threaten to leak sensitive data to pressure the victim into paying. In such scenarios, protecting trade secrets and intellectual property rights becomes exceptionally difficult once the data has been exfiltrated. For a manufacturing entity like Everel, the leak of engineering and operational data could specifically impact supply chain security and competitive advantages.

In general, when organizations face such threats, common defensive steps include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to prevent phishing. Strengthening network segmentation and monitoring for unusual data exfiltration patterns are also critical components of a modern cybersecurity posture to mitigate the impact of ransomware-related data breaches.